Attachment-G1-ACF_ E-Authentication Agreement_V1.0.docx

Enter System Name ACF e-Authentication Enter System Name

Version 1.0 Dated: 6/26/25

Table of Contents

1. Introduction and Purpose This document guides the System Owner through the e-Authentication Threshold Analysis (ETA) to determine if the full E-Authentication Risk Assessment (ERA) process is necessary for the system, per OMB M-04-04, NIST SP 800-63, and HHS security and privacy policies.

2. Threshold Analysis If the answer to any of the following questions is “No,” please proceed to section 4 and sign the document.

If the answer to all three questions is “Yes,” please complete the ERA in section 3 before signing the document.

Table 1. ERA Threshold Analysis

3. E-Authentication Risk Assessment (ERA) This section helps quantify the risk of authentication failure based on potential harm to users, the agency, or the public.

3.1 Step 2: Potential Impact of Authentication Errors

Indicate the potential impact of an authentication error from the system based on the explanations provided for low, moderate, and high impact.

Please note that if the system has multiple types of transactions (e.g., create, update, delete, read), a separate analysis is required for each type's potential impact. The impact level must reflect the maximum possible impact for each transaction type.

3.1.1 Potential impact of inconvenience, distress, or damage to standing or reputation:

Potential Impact Categories for Authentication Errors

☐ Not Applicable

☐ Low: At worst, limited or short-term inconvenience, distress, or embarrassment to any party.

☐ Moderate: At worst, serious short-term or limited long-term inconvenience, distress, or damage to the standing or reputation of any party.

☐ High: Severe long-term inconvenience, distress, or damage to the standing or reputation of any party (ordinarily reserved for situations with particularly severe effects or which affect many individuals).

3.1.2 Potential impact of financial loss:

Potential Impact Categories for Authentication Errors

☐ Not Applicable

☐ Low: At worst, an insignificant or inconsequential unrecoverable financial loss to any party, or at worst, a trivial or inconsequential agency liability.

☐ Moderate: At worst, a serious unrecoverable financial loss to any party, or a serious agency liability.

☐ High: Severe or catastrophic unrecoverable financial loss to any party, or severe or catastrophic agency liability.

3.1.3 Potential impact of harm to agency programs or public interests:

Potential Impact Categories for Authentication Errors

☐ Not Applicable

☐ Low: At worst, a limited adverse effect on organizational operations, assets, or public interests. Examples of limited adverse effects are (i) mission capability degradation to the extent and duration that the organization can perform its primary functions with noticeably reduced effectiveness, or (ii) minor damage to organizational assets or public interests.

☐ Moderate: At worst, a serious adverse effect on organizational operations, assets, or public interests. Examples of serious adverse effects are (i) significant mission capability degradation to the extent and duration that the organization can perform its primary functions with significantly reduced effectiveness, or (ii) significant damage to organizational assets or public interests.

☐ High: A severe or catastrophic adverse effect on organizational operations, assets, or public interests. Examples of severe or catastrophic effects are (i) severe mission capability degradation or loss to the extent and duration that the organization cannot perform one or more of its primary functions, or (ii) significant damage to organizational assets or public interests.

3.1.4 Potential impact of unauthorized release of sensitive information:

Potential Impact Categories for Authentication Errors

☐ Not Applicable

☐ Low: At worst, a limited release of personal, U.S. government sensitive, or commercially sensitive information to unauthorized parties resulting in a loss of confidentiality with a low impact as defined in FIPS 199.

☐ Moderate: At worst, a release of personal, U.S. government sensitive, or commercially sensitive information to unauthorized parties resulting in loss of confidentiality with a moderate impact as defined in FIPS 199.

☐ High: A release of personal, U.S. Government Sensitive, or commercially sensitive information to unauthorized parties resulting in loss of confidentiality with a high impact as defined in FIPS 199.

3.1.5 Potential impact on personal safety:

Potential Impact Categories for Authentication Errors

☐ Not Applicable

☐ Low: At worst, minor injury not requiring medical treatment.

☐ Moderate: At worst, moderate risk of minor injury or limited risk of injury requiring medical treatment.

☐ High: A risk of serious injury or death.

3.1.6 The potential impact of civil or criminal violations is:

Potential Impact Categories for Authentication Errors

☐ Not Applicable

☐ Low: At worst, a risk of civil or criminal violations that would not ordinarily be subject to enforcement efforts.

☐ Moderate: At worst, a risk of civil or criminal violations that may be subject to enforcement efforts.

☐ High: A risk of civil or criminal violations that are especially important to enforcement programs.

3.2 Step 3: Authentication Assurance Level

Compare the values in tables in Section 3.1 with those in Table 3 below.

Choose the Assurance Level Impact Profile value (1, 2, 3, or 4) that best matches the potential impacts in Table 2. Sometimes, a potential impact may fit more than one assurance level. Use the context to decide which assurance level is most appropriate.

Table 2. Assurance Levels

3.3 Final Assurance Level

Identify the dominant, recurring assurance level for each maximum potential impact. This is the system's final assurance level requirement.

Enter assurance level number Enter assurance level

4. Approval and Authorization This eAuthentication has been reviewed and approved by the System Owner.

Enter System Owner name Digital Signature – Date

This eAuthentication has been reviewed and approved by the ACF OCIO CISO (or their delegate).

Enter CISO name Digital Signature – Date

☐ If using a delegate, enter their name and select this box Enter delegate name

Document Revision History

Version 1.0 e-Authentication 1 image1.png image2.png