PR.AA-01:

Identities and credentials for authorized users, services, and hardware are managed by the organization

Implementation Examples

Ex1:

Initiate requests for new access or additional access for employees, contractors, and others, and track, review, and fulfill the requests, with permission from system or data owners when needed

Ex2:

Issue, manage, and revoke cryptographic certificates and identity tokens, cryptographic keys (i.e., key management), and other credentials

Ex3:

Select a unique identifier for each device from immutable hardware characteristics or an identifier securely provisioned to the device

Ex4:

Physically label authorized hardware with an identifier for inventory and servicing purposes