Establish and Maintain an Inventory of Authentication and Authorization Systems
Description
Establish and maintain an inventory of the enterprise’s authentication and authorization systems, including those hosted on-site or at a remote service provider. Review and update the inventory, at a minimum, annually, or more frequently.
Implementation Checklist
Tool Recommendations
Cloud identity and access management with SSO, MFA, conditional access, and identity governance
Microsoft · Per-user subscription (P1/P2)
Cloud identity platform providing SSO, adaptive MFA, lifecycle management, and API access management
Okta · Per-user subscription
Enterprise identity security platform with SSO, MFA, directory, and API security for workforce and customer identity
Ping Identity (Thales) · Per-user subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Undiscovered Authentication System Compromise
ConfidentialityAn authentication system not included in the inventory is compromised, but the breach goes undetected because the system is not monitored, patched, or included in security reviews.
Inconsistent Security Policies Across Unknown Auth Systems
IntegrityAuthentication systems not tracked in the inventory operate with different security policies, creating weak links that attackers target for initial access.
Vulnerabilities (When Safeguard Absent)
No Inventory of Authentication and Authorization Systems
Without a maintained inventory, the organization does not know all the systems that authenticate or authorize users, leaving some unmanaged and potentially misconfigured.
Unmanaged Identity Providers
Authentication systems not captured in the inventory are excluded from security hardening, monitoring, and incident response processes, creating blind spots in identity security.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Document | Current inventory or catalog documentation | Maintained continuously, reviewed quarterly |
| Document | Process/procedure documentation for identification activities | Reviewed annually |
| Technical | Asset/software inventory export with required fields populated | Exported quarterly for review |
| Record | Inventory review meeting minutes or sign-off | Per review cycle |
| Record | Third-party risk assessment reports and scorecards | Annually per vendor |
| Document | Vendor contracts with security requirements | Per contract cycle |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |