{"data":{"id":"IA-08","name":"Identification and Authentication (Non-organizational Users)","family":"IA","family_name":"Identification and Authentication","withdrawn":false,"description":"Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.","supplemental_guidance":"Non-organizational users include system users other than organizational users explicitly covered by IA-2. Non-organizational users are uniquely identified and authenticated for accesses other than those explicitly identified and documented in AC-14. Identification and authentication of non-organizational users accessing federal systems may be required to protect federal, proprietary, or privacy-related information (with exceptions noted for national security systems). Organizations consider many factors—including security, privacy, scalability, and practicality—when balancing the need to ensure ease of use for access to federal information and systems with the need to protect and adequately mitigate risk.","enhancements":[{"id":"IA-08(01)","name":"Acceptance of PIV Credentials from Other Agencies","statement":"Accept and electronically verify Personal Identity Verification-compliant credentials from other federal agencies.","baselines":["low","moderate","high"]},{"id":"IA-08(02)","name":"Acceptance of External Authenticators","statement":"a. Accept only external authenticators that are NIST-compliant; and\nb. Document and maintain a list of accepted external authenticators.","baselines":["low","moderate","high"]},{"id":"IA-08(03)","name":"Use of FICAM-approved Products","withdrawn":true,"incorporated_into":["IA-08(02)"]},{"id":"IA-08(04)","name":"Use of Defined Profiles","statement":"Conform to the following profiles for identity management [Assignment: organization-defined identity management profiles].","baselines":["low","moderate","high"]},{"id":"IA-08(05)","name":"Acceptance of PIV-I Credentials","statement":"Accept and verify federated or PKI credentials that meet [Assignment: organization-defined policy].","baselines":[]},{"id":"IA-08(06)","name":"Disassociability","statement":"Implement the following measures to disassociate user attributes or identifier assertion relationships among individuals, credential service providers, and relying parties: [Assignment: organization-defined measures].","baselines":[]}],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"IA-08","name":"Identification and Authentication (Non-organizational Users)","description":"Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.","discussion":"Non-organizational users include system users other than organizational users explicitly covered by IA-2. Non-organizational users are uniquely identified and authenticated for accesses other than those explicitly identified and documented in AC-14. Identification and authentication of non-organizational users accessing federal systems may be required to protect federal, proprietary, or privacy-related information (with exceptions noted for national security systems). Organizations consider many factors—including security, privacy, scalability, and practicality—when balancing the need to ensure ease of use for access to federal information and systems with the need to protect and adequately mitigate risk.","related_controls":["AC-02","AC-06","AC-14","AC-17","AC-18","AU-06","IA-02","IA-04","IA-05","IA-10","IA-11","IA-13","MA-04","RA-03","SA-04","SC-08"],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":"No significant changes from Rev 4."}},"compliance_mappings":{"iso_27001_2022":["A.5.16","A.8.5"],"iso_27002_2022":["5.16","8.5"],"cobit_2019":["DSS05"],"pci_dss_v4":[],"nist_csf_2":["PR.AA-01","PR.AA-03","PR.AA-04"],"cis_controls_v8":[],"soc2_tsc":[],"finos_ccc":[],"iso_42001_2023":[],"iec_62443":["3-3 SR 1.1"],"asd_e8":[],"nis2":[],"apra_cps_234":[],"mas_trm":["9"],"pra_op_resilience":[],"bsi_grundschutz":["ORP.4"],"anssi":[],"osfi_b13":[],"finma_circular":[],"gdpr":[],"dora":["Art.9(4)(d)"],"bio2":["5.16","8.5"],"rbi_csf":["Annex1.9"],"fisc":["FISC.T2"],"lgpd_bcb":["BCB.OpenFinance","BCB.PIX"],"hkma_tme1":["TME1.8.3"],"mlps_2":["8.1.4.1"],"dnb_good_practice":["DNB.17.1"],"cra":["CRA.I.2d"],"swift_cscf":[],"cbb_tm":["TM-6"],"cbuae":["CR-4"],"nca_ecc":["2-2"],"qatar_nia":["AC"],"sama_csf":["3.1"],"uae_ia":["T9"],"bog_cisd":["CISD-IX","CISD-VIII"],"bom_ctrm":["3.3","3.13"],"cbe_csf":["CTO-1","CTO-5"],"cbn_csf":["Part3.2","Part5.2"],"sa_js2":["JS2-7.1","JS2-8.1"],"bot_cyber":["Ch2.2"],"cpmi_pfmi":["CG.PR"],"eba_ict":["3.4.2","3.8(b)"],"ecb_croe":["CROE.2.3.1"],"ffiec_is":["II.C.15","II.C.15(b)","II.C.15(c)","II.C.16"],"hipaa_sr":["§164.310(a)(2)(iii)","§164.312(a)(2)(i)","§164.312(d)"],"iosco_cyber":["PROT-1"],"nydfs_500":["500.12"],"sebi_cscrf":["PR.AA"],"cmmc_2":["IA"],"nerc_cip":["CIP-005-7"],"nrc_73_54":["RG5.71-A-AC"],"tsa_psd":["SD-2 Sec B"],"ieee_1686":[],"ferc_cip":[],"doe_c2m2":["ACCESS"],"api_1164":["Sec 6"],"awia":[],"iaea_nss":["Sec 5.2"],"pci_pts":[],"fips_140":[],"cbest":[],"tiber_eu":[],"pci_hsm":["9"],"common_criteria":["CC Part 2 — FIA"],"isae_3402":[],"fca_sysc_13":["SYSC 13.7.3"],"fda_21_cfr_11":["§11.100(a)"],"fda_cyber":["SA-1"],"hitrust_csf":[],"iso_27799":["H.5"],"lloyds_ms":["BP2.1","MS8.3"],"naic_ds":["4-access"],"nhs_dspt":["NDG-4.3"],"pra_ss1_23":[],"solvency_ii":["EIOPA-ICT-4.4"],"owasp_masvs_v2":["MASVS-AUTH-1"],"csa_ccm_v4":["IAM-14"],"csa_aicm":["IAM-14"],"ccss_v9":[],"mica":[],"basel_sco60":[],"bssc":[],"sec_custody_digital":[],"dpdpa":[]},"attack_techniques":[{"id":"T1053","name":"Scheduled Task/Job","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Authenticating non-organizational users before granting system access prevents external adversaries from creating scheduled tasks without first establishing a verified identity."},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Requiring authentication of non-organizational users before system access prevents unauthenticated external actors from executing commands through scripting interpreters on organizational systems."},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"mapping_type":"mitigates","mapping_rationale":"Authenticating non-organizational users accessing public-facing applications adds an identity verification layer that limits anonymous exploitation of application vulnerabilities for initial access."},{"id":"T1210","name":"Exploitation of Remote Services","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Requiring authentication of external users accessing remote services prevents unauthenticated adversaries from exploiting internal service vulnerabilities for lateral movement."},{"id":"T1213","name":"Data from Information Repositories","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Authenticating non-organizational users before granting access to information repositories prevents anonymous data collection from wikis, SharePoint, and other knowledge bases."},{"id":"T1528","name":"Steal Application Access Token","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Enforcing strong authentication for non-organizational API consumers limits adversaries' ability to steal and abuse application access tokens issued to external partners."},{"id":"T1530","name":"Data from Cloud Storage","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Authenticating non-organizational users accessing cloud storage and enforcing identity verification prevents anonymous access to cloud-hosted organizational data."},{"id":"T1537","name":"Transfer Data to Cloud Account","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Requiring authentication for all cloud data transfer operations ensures that non-organizational adversaries cannot anonymously transfer data to external cloud accounts."},{"id":"T1538","name":"Cloud Service Dashboard","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Authenticating non-organizational users accessing cloud dashboards prevents unauthorized external actors from discovering cloud infrastructure through unauthenticated console access."},{"id":"T1542","name":"Pre-OS Boot","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Requiring strong authentication for firmware and boot configuration interfaces ensures non-organizational users cannot modify pre-OS boot mechanisms without verified identity."},{"id":"T1053.007","name":"Container Orchestration Job","tactics":["execution","persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Authenticating non-organizational users accessing container orchestration platforms prevents external adversaries from scheduling container jobs without verified identity credentials."},{"id":"T1059.001","name":"PowerShell","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Requiring authentication for remote PowerShell access ensures non-organizational users cannot execute PowerShell commands on organizational systems without verified identity."},{"id":"T1059.008","name":"Network Device CLI","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Authenticating non-organizational users accessing network device CLIs prevents external adversaries from executing device commands without verified identity credentials."},{"id":"T1087.004","name":"Cloud Account","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Requiring authentication before cloud directory access prevents non-organizational users from anonymously enumerating cloud accounts and discovering organizational identities."},{"id":"T1213.001","name":"Confluence","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Authenticating non-organizational users before Confluence access prevents external adversaries from anonymously browsing wiki content and collecting sensitive organizational information."},{"id":"T1213.002","name":"Sharepoint","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Requiring authentication for SharePoint access ensures non-organizational users cannot anonymously access document libraries and harvest organizational data."},{"id":"T1213.004","name":"Customer Relationship Management Software","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Authenticating external users accessing CRM platforms prevents adversaries from anonymously extracting customer relationship data from organizational CRM systems."},{"id":"T1213.005","name":"Messaging Applications","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Requiring authentication for messaging application access prevents non-organizational users from accessing organizational communications without verified identity."},{"id":"T1542.001","name":"System Firmware","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Authenticating access to firmware update interfaces ensures that non-organizational users cannot modify system BIOS or UEFI firmware without verified credentials."},{"id":"T1542.003","name":"Bootkit","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Requiring authentication for bootloader configuration access prevents non-organizational users from installing bootkits without establishing verified system access."},{"id":"T1542.005","name":"TFTP Boot","tactics":["defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Authenticating TFTP boot server access and requiring identity verification for network boot configurations prevents external adversaries from redirecting device boot processes."},{"id":"T1547.006","name":"Kernel Modules and Extensions","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Requiring strong authentication for kernel module loading operations prevents non-organizational users from installing unauthorized kernel modules without verified privileged access."}],"metadata":{"last_reviewed":"2026-02-19","review_notes":"Generated from NIST SP 800-53 Rev 5 with compliance mappings from framework-coverage data","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-028","SP-029","SP-030","SP-032","SP-041","SP-044","SP-047","SP-052","SP-054"]}}