V-204808

Discussion

Access may be denied to legitimate users if FICAM-approved third-party credentials are not accepted. This requirement typically applies to organizational information systems that are accessible to non-federal government agencies and other partners. This allows federal government relying parties to trust such credentials at their approved assurance levels. Third-party credentials are those credentials issued by nonfederal government entities approved by the FICAM Trust Framework Solutions initiative.

Check Content

Review the application server documentation and configuration to determine if the application server accepts FICAM-approved third-party credentials.

If the application server does not accept FICAM-approved third-party credentials, this is a finding.