---
id: os_auth_peripherals
title: Must Authenticate Before Establishing a Connection
discussion: |-
  Organizational devices requiring unique device-to-device identification and authentication may be defined by type, by device, or by a combination of type/device. Information systems typically use either shared known information (e.g., Media Access Control [MAC] or Transmission Control Protocol/Internet Protocol [TCP/IP] addresses) for device identification or organizational authentication solutions (e.g., IEEE 802.1x and Extensible Authentication Protocol [EAP], Radius server with EAP-Transport Layer Security [TLS] authentication, Kerberos) to identify/authenticate devices on local and/or wide area networks. Organizations determine the required strength of authentication mechanisms by the security categories of information systems. Because of the challenges of applying this control on large scale, organizations are encouraged to only apply the control to those limited number (and type) of devices that truly need to support this capability.

  NOTE: The technology does support this requirement, however, third party solutions are required to implement at an infrastructure level.
references:
  nist:
    cce:
      macos_27:
        - CCE-XXXXX-X
      macos_26:
        - CCE-95163-2
      macos_15:
        - CCE-94163-3
      macos_14:
        - CCE-92763-2
    800-53r5:
      - IA-3
    800-171r3:
      - 03.05.02
  disa:
    srg:
      - SRG-OS-000114-GPOS-00059
      - SRG-OS-000378-GPOS-00163
    cmmc:
      - IA.L1-3.5.2
  hhs:
    hicp:
      - 3.L.A
      - 6.L.A
  cis:
    controls_v8:
      - 13.9
platforms:
  macOS:
    '27.0': {}
    '26.0': {}
    '15.0': {}
tags:
  - 800-53r5_moderate
  - 800-53r5_high
  - permanent
  - cisv8
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - cmmc_lvl1
  - cnssi-1253_moderate
  - hicp_lp
