The organization: IA-1a.
Develops, documents, and disseminates to Assignment: organization-defined personnel or roles: IA-1a.1.
An identification and authentication policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and IA-1a.2.
Procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls; and IA-1b.
Reviews and updates the current: IA-1b.1.
Identification and authentication policy Assignment: organization-defined frequency; and IA-1b.2.
Identification and authentication procedures Assignment: organization-defined frequency.