NIST 800-53 r5 · Controls catalogue · Family IA
IA-3Device Identification and Authentication
Uniquely identify and authenticate {{ insert: param, ia-03_odp.01 }} before establishing a {{ insert: param, ia-03_odp.02 }} connection.
Last updated: 15 October 2026 12:19 UTC
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (8)
- T1530 Data from Cloud Storage Collection
- T1537 Transfer Data to Cloud Account Exfiltration
- T1552 Unsecured Credentials Credential Access
- T1552.005 Cloud Instance Metadata API Credential Access
- T1602 Data from Configuration Repository Collection
- T1602.001 SNMP (MIB Dump) Collection
- T1602.002 Network Device Configuration Dump Collection
- T1621 Multi-Factor Authentication Request Generation Credential Access
Weaknesses this control addresses (5)AI-assisted
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-287 | Improper Authentication | 5,600+ | Enforces unique device identification and authentication before any connection is established, directly mitigating improper authentication weaknesses. |
CWE-306 | Missing Authentication for Critical Function | 3,900+ | Requires authentication of devices prior to connection, preventing exploitation of missing authentication for critical network functions. |
CWE-290 | Authentication Bypass by Spoofing | 800+ | Unique device authentication makes successful spoofing of device identity substantially more difficult to achieve. |
CWE-300 | Channel Accessible by Non-Endpoint | 60 | Ensures only authenticated endpoints can access the communication channel, blocking unauthorized non-endpoint access. |
CWE-291 | Reliance on IP Address for Authentication | 11 | Mandates proper device-level authentication instead of weaker identifiers such as IP addresses that are easily forged. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
CVE-2025-61932 KEV UPD | 9.9 | 9.8 | 0.0277 | good |
CVE-2026-86426 UPD | 7.9 | 9.8 | 0.0387 | good |
CVE-2026-1709 UPD | 7.7 | 9.4 | 0.0579 | good |
CVE-2026-1490 UPD | 7.5 | 9.8 | 0.0128 | good |
CVE-2026-76657 | 7.5 | 10.0 | 0.0075 | good |
CVE-2026-76658 | 7.5 | 10.0 | 0.0075 | good |
CVE-2026-75816 | 7.5 | 9.8 | 0.0091 | good |
CVE-2024-40515 UPD | 7.4 | 9.8 | 0.0066 | good |
CVE-2024-38886 UPD | 7.4 | 9.8 | 0.0065 | good |
CVE-2024-41889 UPD | 7.4 | 9.8 | 0.0068 | good |
CVE-2026-74232 UPD | 7.4 | 9.8 | 0.0081 | good |
CVE-2026-85595 UPD | 7.4 | 9.8 | 0.0069 | good |
CVE-2026-85596 UPD | 7.3 | 9.8 | 0.0043 | good |
CVE-2026-13447 | 7.3 | 9.8 | 0.0045 | good |
CVE-2026-18922 UPD | 7.3 | 9.8 | 0.0056 | good |
CVE-2026-79576 | 7.3 | 9.8 | 0.0048 | good |
CVE-2026-49003 | 7.2 | 9.6 | 0.0240 | good |
CVE-2023-28078 UPD | 7.0 | 9.1 | 0.0089 | good |
CVE-2026-84197 | 7.0 | 9.2 | 0.0034 | good |
CVE-2026-80099 | 7.0 | 8.8 | 0.0291 | good |
CVE-2026-61568 UPD | 6.8 | 9.6 | 0.0053 | partial |
CVE-2024-24974 UPD | 6.7 | 7.5 | 0.0976 | good |
CVE-2026-34205 | 6.7 | 9.6 | 0.0035 | good |
CVE-2026-2611 UPD | 6.7 | 9.6 | 0.0041 | good |
CVE-2026-85085 | 6.7 | 9.6 | 0.0039 | good |