Attachment A - Judiciary Identity_ Authentication_ and Access Management Requirements.pdf
PDF 647 KB Posted
- Attached to
- Web-based Jury Management System (JMS)
- Solicitation number
- USCA26R0000
- Issued by
-
Administrative Office of the U.S. Courts
About this file
This is an appendix document outlining Judiciary Identity, Authentication, and Access Management Requirements for federal contract work.
The document establishes mandatory identity and authentication standards for Judiciary applications based on the Judiciary Information Security Framework (JISF) and NIST Digital Identity Guidelines. For public-facing applications, vendors must integrate with Login.gov, a Credential Service Provider (CSP), to provide federated Identity and Access Management services supporting single sign-on (SSO), phishing-resistant multi-factor authentication (MFA), and centralized identity management. For internal applications serving judges, court staff, and Administrative Office personnel, vendors must integrate with Azure AD (Microsoft Entra ID) as the enterprise identity provider, supporting standards-based federation protocols including SAML 2.0, OpenID Connect (OIDC), and OAuth 2.0. The requirements establish that identity proofing (IA-12) is mandatory for systems categorized as Moderate (M) or High (H) impact, with in-person validation required for High categorization systems. Multi-factor authentication (IA-02) is mandatory across all system impact levels (High, Moderate, and Low) for both privileged and non-privileged organizational user accounts. Agencies must implement a minimum Authenticator Assurance Level 2 (AAL2) when applications process, store, or transmit Personally Identifiable Information (PII) or personal information online, requiring two distinct authentication factors. Vendors must comply with referenced NIST standards including NIST SP 800-63C-4 (Federation and Assertions) and NIST SP 800-63B-4 (Authentication and Authenticator Management, specifically Section 7.1.2 on OAuth Access Tokens).
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Attachment A – Judiciary Identity, Authentication, and Access Management Requirements
Judiciary applications that require public access should integrate with a federated Identity and Access Management (IAM) / Identity Provider (IdP) vendor to provide secure authentication and identity services. This approach supports capabilities such as single sign-on (SSO), strong authentication with phishing-resistant MFA options, centralized identity management, and compliance with federal identity and security standards.
The Judiciary is currently using Login.gov, a Credential Service Provider (CSP), to serve as the identity provider for public facing applications, including JMS-eJuror, which is classified as a Medium to High data classification system. Leveraging Login.gov enables secure public user authentication while supporting required security, operational, and performance standards in alignment with TSIO guidance.
Additional implementation guidance and requirements are documented in the TSIO MFA Public Access Requirements documentation (reference link provided), which outlines the recommended approach for enabling secure authentication for public-facing Judiciary applications.
Internal Judiciary applications used by organizational users (judges, court staff, and AO personnel) should integrate with an enterprise Identity and Access Management (IAM) / Identity Provider (IdP) platform for authentication and identity management. This approach enables centralized Single Sign-On (SSO), Multi-Factor Authentication (MFA), and identity governance capabilities aligned with enterprise security practices and federal identity standards. It also supports standards-based federation protocols such as SAML 2.0, OpenID Connect (OIDC), and OAuth 2.0, enabling secure and consistent access across internal systems.
Currently, the Judiciary leverages Azure AD (Microsoft Entra ID) as part of its enterprise identity infrastructure to support authentication and access management for organizational users, providing centralized identity services and secure access to internal applications.
Based on the Judiciary Information Security Framework (JISF) and the NIST Digital Identity Guidelines, the requirement to support standards-based single sign-on (SSO) and identity federation protocols is supported through the following controls and guidelines:
1. Is Identity Proofing and MFA Mandatory?
• Identity Proofing (IA-12): This is mandatory for all Judiciary information systems categorized as Moderate (M) or High (H). It is considered optional (Opt) for systems categorized as Low (L). For High categorization systems, the validation of identity evidence must be conducted in person before a designated registration authority.
DRAFT
• MFA (IA-02): Multi-factor authentication is mandatory for Judiciary organizational users across all system impact levels (High, Moderate, and Low). Specifically:
o MFA is required for access to privileged accounts.
o MFA is required for access to non-privileged accounts.
• AAL2 Requirements: Agencies must select a minimum of Authenticator Assurance
Level 2 (AAL2), which requires MFA, whenever Personally Identifiable Information (PII) or other personal information is made available online.
• System Security Categorization: Perform a security categorization (RA-02) to determine if the application is Low, Moderate, or High impact.
o If the application is Moderate or High, identity proofing (IA-12) is mandatory.
• Presence of Sensitive Data (PII): If the application processes, stores, or transmits PII or personal information online, it must use at least AAL2.
o AAL2 requires the use of two distinct authentication factors (MFA).
The requirement to comply with the NIST Digital Identity Guidelines has been established in this SOO. The citations and links below are provided to support vendor review of the referenced standards.
• NIST SP 800-63C-4 (Digital Identity Guidelines: Federation and Assertions):
o Link: https://doi.org/10.6028/NIST.SP.800-63c-4.
• NIST SP 800-63B-4 (Authentication and Authenticator Management):
o Section 7.1.2: Access Tokens (OAuth).
o Link: https://doi.org/10.6028/NIST.SP.800-63b-4.
o Link: https://doi.org/10.6028/NIST.SP.800-63-4.
DRAFT
https://doi.org/10.6028/NIST.SP.800-63c-4 https://doi.org/10.6028/NIST.SP.800-63b-4 https://www.google.com/url?sa=E&q=https%3A%2F%2Fdoi.org%2F10.6028%2FNIST.SP.800-63-4
DRAFT
File details come from the government source that posted it. Updated .