The application server must accept Federal Identity, Credential, and Access Management (FICAM)-approved third-party credentials.

Access may be denied to legitimate users if FICAM-approved third-party credentials are not accepted.

This requirement typically applies to organizational information systems that are accessible to non-federal government agencies and other partners. This allows federal government relying parties to trust such credentials at their approved assurance levels.

Third-party credentials are those credentials issued by nonfederal government entities approved by the FICAM Trust Framework Solutions initiative.

Review the application server documentation and configuration to determine if the application server accepts FICAM-approved third-party credentials.

If the application server does not accept FICAM-approved third-party credentials, this is a finding.

Configure the application server to accept FICAM-approved third-party credentials.