CISA and NSA Identity and Access Management Recommended Best Practices Guide: The ESF Series Explained and Applied

Attackers increasingly log in rather than break in, and the US government's own joint identity guidance was written to close exactly that gap. In 2023 NSA and CISA, working through the Enduring Security Framework (ESF), published two companion documents on identity and access management: recommended best practices for administrators, and a report on the challenges developers and vendors of multi-factor authentication (MFA) and single sign-on (SSO) need to fix. NSA also published guidance on maturing identity in the zero trust User pillar the same month. This guide explains what each document covers, turns the five administrator topics into an implementation plan, shows what the vendor report means when you buy or configure identity products, and maps it all to the frameworks auditors use. It is written for identity administrators, architects and security leads.

Key takeaways

• Three documents, one message: the administrators' best practices (21 March 2023), the developer and vendor challenges report (4 October 2023) and the NSA User pillar information sheet (14 March 2023) all centre on governing identities, hardening identity infrastructure and using strong MFA.
• Five administrator topics: identity governance, environmental hardening, identity federation and SSO, multi-factor authentication, and IAM auditing and monitoring.
• Not all MFA is equal: the vendor report calls SMS among the least secure options and describes PKI and FIDO2 as resistant to phishing attacks; enrolment itself is an attack surface.
• Standards are table stakes: the report says SCIM should be table stakes for relying parties, urges OAuth 2.0 and OIDC alongside SAML, and calls SSO a table stakes feature for organisations of all sizes.
• Use it as a buyer as well as an operator: the vendor report is a ready-made list of questions to put to identity and SaaS vendors.

The documents and how they relate

The ESF is a public-private, cross-sector partnership that addresses risks to critical infrastructure and national security systems. The administrators' release cites the 2021 Colonial Pipeline ransomware attack, which involved a leaked password, an inactive VPN account and no multi-factor authentication, as the kind of failure the guidance targets. The User pillar sheet fits the guidance into the DoD zero trust model; see the DoD Zero Trust Strategy and Reference Architecture Guide.

Applying the five administrator topics

The administrators' guide groups its recommendations into five topics. The table turns each into the controls most organisations need and the evidence that shows they work. The control lists are NHI Mgmt Group's practitioner translation of the topics, informed by the companion documents, not a reproduction of the guide's text.

Identity governance

• Inventory first: the User pillar sheet states that identity management begins with a current and accurate inventory of all users, including non-person entities, and their credentials. Include service accounts, API keys and certificates in that inventory.
• Automate lifecycle removal: the same sheet recommends automating removal of privileges on lifecycle events such as role changes or retirement. See the Joiner-Mover-Leaver Guide.
• Dormant accounts: the inactive VPN account in the Colonial Pipeline example is the archetype. Disable accounts unused for a set period and remove them after review.

Environmental hardening

• Treat identity systems as tier zero: domain controllers, identity providers, federation servers, PKI and PAM vaults can mint access to everything. Restrict who administers them and from where.
• Dedicated admin devices: the User pillar sheet recommends PAM tools and dedicated privileged access devices because threat actors continue to target administrator credentials. See the Privileged Access Workstations Guide.
• Protect key material: the vendor report warns that storing federation keys on disk opens the door to adversaries. Use hardware security modules or managed key services for token-signing keys. See the Golden SAML and Federation Trust Abuse Defence Guide.

Federation and SSO

• Centralise, then minimise: route every application through SSO, then disable local sign-in where the application allows, keeping only monitored break-glass access.
• Configure securely: the vendor report notes SAML has a number of security pitfalls that require careful configuration, and asks relying-party vendors to add OAuth 2.0 and OIDC support. Validate signatures, audience and expiry, and keep token lifetimes short. See the SAML Security Guide.
• Manage complexity: the report warns against SSO deployments that are impossible to manage securely and advises checking that staffing can support the platform chosen.

Multi-factor authentication

• Choose by security property, not by label: the vendor report says SMS-based MFA is considered among the least secure options and describes PKI and FIDO2 as resistant to phishing. The User pillar sheet notes that certain cryptographic authenticators, known as phishing-resistant MFA, provide phishing resistance. See the Phishing-Resistant MFA Guide.
• Secure enrolment: the report flags that many MFA types rely on user self-enrolment and that the one-time enrolment code flow is itself a target. Bind first enrolment to verified identity (in person, a verified video check or a temporary access credential issued after HR verification) and alert on new methods added to existing accounts.
• Govern the authenticator lifecycle: the report states that strong governance over the MFA authenticator lifecycle allows more trust to be placed in MFA, and asks vendors for tools to find and purge enrolled authenticators that are not used. Review registered methods periodically and remove stale ones.
• Recovery is part of MFA: a help desk that resets MFA on a phone call undoes all of the above. See the Account Recovery and Help Desk Security Guide.

Auditing and monitoring

The administrators' release quotes NSA's lead for the working group making the point that malicious actors hide their activity by exploiting legitimate credentials. That means detection has to focus on how valid accounts are used: sign-ins from unusual locations or devices, MFA method changes, privilege grants, new application credentials and federation trust changes. Map detections to MITRE ATT&CK T1078 Valid Accounts, T1556 Modify Authentication Process, T1098 Account Manipulation and T1621 Multi-Factor Authentication Request Generation. See the ITDR Guide.

The developer and vendor challenges, and what to ask suppliers

The October 2023 report is addressed to vendors, but it is equally useful to buyers. Each challenge becomes a procurement question.

For provisioning and session standards, see the SCIM Provisioning Guide and the Risk-Based and Adaptive Authentication Guide.

Where identity fits: non-person entities

The User pillar sheet explicitly includes non-person entities in the identity inventory. In practice, service accounts, workload identities, API keys, certificates and AI agents now outnumber people in most environments, and they rarely benefit from MFA or SSO. Apply the same five topics to them: govern (owner, purpose, expiry), harden (no interactive logon, managed or federated workload identity instead of static secrets), federate (workload identity federation instead of long-lived keys), authenticate strongly (certificates, short-lived tokens) and monitor (alert on use from new networks). The Dropbox Sign breach, in which an attacker used a compromised back-end service account with broad production privileges, shows why. See the NHI Ownership Guide.

Implementation: a phased plan

1. Assess (weeks 1 to 4): score current state against the five topics and the User pillar maturity levels (Preparation, Basic, Intermediate, Advanced). Record evidence for each score.
2. Close the entry points (months 1 to 3): MFA on every external entry point, legacy authentication blocked, dormant accounts disabled. Deploy policies in report-only mode first, review impact, then enforce for a pilot group before everyone, with the previous policy exported for rollback.
3. Protect tier zero (months 2 to 6): privileged access devices, phishing-resistant MFA for administrators, signing keys in hardware, restricted administration of identity systems.
4. Govern lifecycle (months 3 to 9): HR-driven provisioning, access reviews, and an owned inventory of non-person entities. See the Identity Lifecycle Event Design Guide.
5. Federate and consolidate (months 6 to 12): bring the application long tail into SSO and SCIM; remove local accounts.
6. Monitor and respond (continuous): centralise identity logs, build valid-account detections, and rehearse an identity provider compromise. See the Identity Provider Tenant Compromise Playbook.

Decision guidance

• Small organisations: start with MFA on email and remote access, separate admin accounts, and SSO for core SaaS. The vendor report's point about SSO pricing is aimed squarely at you: choose SaaS tiers that include SSO and SCIM, because adding them later costs more.
• Mid-sized organisations: add phishing-resistant MFA for administrators, a privileged access tool, and centralised identity logging with a small set of detections.
• Large and regulated organisations: use the User pillar maturity levels as the measurement scale and map evidence to the frameworks below, so one assessment serves auditors, regulators and zero trust reporting.
• Push versus phishing-resistant: push with number matching is a reasonable interim step for the general workforce; for administrators and external access, go straight to FIDO2 or certificates.

Detection and measurement

• MFA coverage: share of sign-ins with MFA, and with phishing-resistant MFA, by population.
• Dormant accounts: enabled accounts with no sign-in for 90 days, human and non-human.
• SSO coverage: share of applications behind SSO, and those with local sign-in still enabled.
• Tier-zero exposure: number of accounts able to administer identity systems.
• Stale authenticators: registered MFA methods unused for 180 days.
• Detection response: median time from valid-account anomaly alert to containment.

Framework mapping

Common failure patterns

• The forgotten entry point: an old VPN account or remote portal without MFA, as in the Colonial Pipeline example and the Change Healthcare intrusion, where attackers used a stolen login on a remote access portal with no multi-factor check. See the Change Healthcare breach analysis.
• Weak enrolment: strong authenticators enrolled through a weak process, so an attacker who controls the enrolment step controls the account.
• SSO with local back doors: applications behind SSO that still accept local passwords, bypassing MFA and offboarding.
• Signing keys on disk: federation keys stored where a server compromise can extract them, allowing forged tokens.
• People-only scope: governance and MFA programmes that ignore service accounts and keys.
• Logging without detection: identity logs collected but no alerts on how valid accounts are used.

Practitioner checklist

• Read the administrators' guide, the developer and vendor report and the User pillar sheet together, and score yourself against the five topics.
• Inventory all accounts, including non-person entities, and reconcile to authoritative sources.
• Enforce MFA on every external entry point and phishing-resistant MFA for administrators.
• Bind MFA enrolment and recovery to verified identity and purge unused authenticators.
• Treat directories, identity providers, federation servers and PKI as tier-zero assets.
• Store token-signing keys in hardware or managed key services.
• Bring applications into SSO and SCIM and disable local sign-in.
• Use the vendor report's challenges as procurement questions for identity and SaaS suppliers.
• Build detections for anomalous use of valid accounts and changes to authentication.

Standards and references

• NSA: ESF Partners, NSA, and CISA Release Identity and Access Management Recommended Best Practices for Administrators
• NSA and CISA (ESF): Developer and Vendor Challenges to Identity and Access Management
• NSA: NSA and ESF Partners Release Report on MFA and SSO Challenges
• NSA: Advancing Zero Trust Maturity Throughout the User Pillar
• NIST: SP 800-63B-4 Authentication and Authenticator Management
• NIST: SP 800-53 Rev. 5
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: Identity Security Programme Guide · Identity Provider and SSO Security Guide · Phishing-Resistant MFA Guide · CISA Cross-Sector Cybersecurity Performance Goals (CPGs) Guide · DoD Zero Trust Strategy and Reference Architecture Guide