FR 1 — Identification & Authentication Control (IAC)

Ensure every human, device, and workload is uniquely identified and strongly authenticated before access is allowed.

• Hardware-rooted device identity and enrollment with attestation
• Passwordless authentication options (machine fingerprint / strong factors)
• Identity inventory with last-seen, posture, and verification history
• Step-up verification for sensitive OT operations (engineering access, remote maintenance)

• Scope by zone: identify where this FR is most critical (e.g., safety zone, engineering access, remote vendor conduit).
• Start in observe mode: baseline behavior and identify necessary exceptions.
• Enforce gradually: enable controls in phases aligned to maintenance windows; document exceptions.
• Continuously verify: monitor drift and anomalies; automate response where safe.

• Enrollment records and attestation results
• Authentication event logs (success/fail, method, device identity)
• Identity lifecycle changes (rotation, revoke, re-enroll)