# IA-02 Identification and Authentication (Organizational Users)

NIST SP 800-53 control. Family: IA Identification and Authentication. Function: preventative. Baselines: low, moderate, high. Mapping licence: CC BY-SA 4.0.

Statement: Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.
Guidance: Organizations can satisfy the identification and authentication requirements by complying with the requirements in [HSPD 12]. Organizational users include employees or individuals who organizations consider to have an equivalent status to employees (e.g., contractors and guest researchers). Unique identification and authentication of users applies to all accesses other than those that are explicitly identified in AC-14 and that occur through the authorized use of group authenticators without individual authentication. Since processes execute on behalf of groups and roles, organizations may require unique identification of individuals in group accounts or for detailed accountability of individual activity. Organizations employ passwords, physical authenticators, or biometrics to authenticate user identities or, in the case of multi-factor authentication, some combination thereof. Access to organizational systems is defined as either local access or network access. Local access is any access to organizational systems by users or processes acting on behalf of users, where access is obtained through direct connections without the use of networks. Network access is access to organizational systems by users (or processes acting on behalf of users) where access is obtained through network connections (i.e., nonlocal accesses). Remote access is a type of network access that involves communication through external networks. Internal networks include local area networks and wide area networks. The use of encrypted virtual private networks for network connections between organization-controlled endpoints and non-organization-controlled endpoints may be treated as internal networks with respect to protecting the confidentiality and integrity of information traversing the network. Identification and authentication requirements for non-organizational users are described in IA-8.

## Enhancements (8)
- IA-02(01) Multi-factor Authentication to Privileged Accounts. Baselines: low, moderate, high
- IA-02(02) Multi-factor Authentication to Non-privileged Accounts. Baselines: low, moderate, high
- IA-02(05) Individual Authentication with Group Authentication. Baselines: high
- IA-02(06) Access to Accounts —separate Device
- IA-02(08) Access to Accounts — Replay Resistant. Baselines: low, moderate, high
- IA-02(10) Single Sign-on
- IA-02(12) Acceptance of PIV Credentials. Baselines: low, moderate, high
- IA-02(13) Out-of-band Authentication
Withdrawn by NIST: IA-02(03) (now in IA-02(01)); IA-02(04) (now in IA-02(02)); IA-02(07) (now in IA-02(06)); IA-02(09) (now in IA-02(08)); IA-02(11) (now in IA-02(06)).
Each enhancement's statement: /api/v1/controls/IA-02?fields=enhancements

## Patterns that use it (24)
- Critical (16): SP-005 SOA Internal Service Usage Pattern; SP-006 Wireless- Private Network Pattern; SP-007 Wireless- Public Hotspot Pattern; SP-011 Cloud Computing Pattern; SP-015 Secure Remote Working; SP-021 Realtime Collaboration Pattern; SP-022 Board of Directors Room; SP-029 Zero Trust Architecture; SP-030 API Security; SP-032 Modern Authentication; SP-033 Passkey Authentication; SP-037 Privileged User Management; SP-044 SaaS Identity Lifecycle Management; SP-048 Offensive AI and Deepfake Defence (draft); SP-050 Mobile Security Architecture (draft); SP-054 CBDC and Digital Currency Infrastructure (draft)
- Important (7): SP-001 Client Module; SP-002 Server Module; SP-013 Data Security Pattern; SP-023 Industrial Control Systems; SP-028 Secure DevOps Pipeline Pattern; SP-034 Cyber Resilience; SP-052 Decentralised Identity & Verifiable Credentials (draft)
- Standard (1): SP-017 Secure Network Zone Module

## Clauses by framework (81 frameworks)
- iso_27001_2022: A.5.16, A.8.5. OSA's own, not in NIST's crosswalk: A.8.5
- iso_27002_2022: 5.16, 8.5
- cobit_2019: DSS05
- pci_dss_v4: 8.1, 8.3, 8.4, 8.5
- nist_csf_2: PR.AA-01, PR.AA-03, PR.AA-04. OSA's own, not in NIST's crosswalk: PR.AA-04
- cis_controls_v8: CIS 5, CIS 5.6, CIS 6.3, CIS 6.4, CIS 6.5, CIS 12.5, CIS 12.7
- soc2_tsc: CC6.1, CC6.1-POF3, CC6.1-POF4, CC6.1-POF8
- finos_ccc: CCC-C03, CCC-C11
- iec_62443: 3-3 SR 1.1
- asd_e8: E8-7, E8-7 ML1, E8-7 ML2, E8-7 ML3
- nis2: Art. 21(2)(j)
- mas_trm: 9, 14
- bsi_grundschutz: ORP.4
- anssi: Hygiene.10, Hygiene.11, Hygiene.12, RGS.2.2, SecNumCloud.10.5
- osfi_b13: B-13.3.2
- finma_circular: IV.B.d(59), IV.B.d(60), IV.C(61)
- gdpr: Art.32(1)(b), Art.32(1)(d)
- dora: Art.9(4)(c), Art.9(4)(d)
- bio2: 5.16, 8.5
- rbi_csf: Annex1.8, Annex1.9, ITGRCA.19
- fisc: FISC.T2, FISC.T10, FISC.T11
- lgpd_bcb: BCB.Art.3, BCB.OpenFinance, BCB.PIX, LGPD.Art.46
- hkma_tme1: TME1.8.2, TME1.8.3, TME1.8.5, TME1.10.2, TME1.10.4
- mlps_2: 8.1.4.1, 8.2
- dnb_good_practice: DNB.17.1
- cra: CRA.I.2d
- swift_cscf: SWIFT.1.2, SWIFT.4.2
- cbb_tm: TM-6
- cbuae: CR-4
- nca_ecc: 2-2, 5-1
- qatar_nia: AC
- sama_csf: 3.1
- uae_ia: T9
- bog_cisd: CISD-IX, CISD-VIII
- bom_ctrm: 3.3, 3.13
- cbe_csf: CTO-1, CTO-5
- cbn_csf: Part3.2, Part5.2
- popia: s19
- sa_js2: JS2-7.1, JS2-8.1
- bot_cyber: Ch2.2, Ch8.2, Ch9.1
- cpmi_pfmi: CG.PR, PFMI.P17
- eba_ict: 3.4.2, 3.8(b)
- ecb_croe: CROE.2.3.1
- ffiec_is: II.C.7(b), II.C.15, II.C.15(a), II.C.15(b), II.C.15(c), II.C.16
- hipaa_sr: §164.310(a)(2)(iii), §164.312(a)(2)(i), §164.312(d)
- iosco_cyber: PROT-1
- nydfs_500: 500.7, 500.12
- sebi_cscrf: PR.AA
- cmmc_2: AC, IA
- nerc_cip: CIP-005-7
- nrc_73_54: RG5.71-A-AC
- tsa_psd: SD-2 Sec B
- ieee_1686: 5.1
- ferc_cip: Order 850
- doe_c2m2: ACCESS
- api_1164: Sec 6
- awia: AWWA Sec 3
- iaea_nss: Sec 5.2
- pci_pts: C
- fips_140: FIPS 140-3 §7.4
- common_criteria: CC Part 2 — FIA
- isae_3402: Clause 4
- fca_sysc_13: SYSC 13.7.3
- fda_21_cfr_11: §11.10(d), §11.100(a), §11.200(a)(1), §11.200(a)(1)(ii), §11.200(a)(2), §11.200(a)(3)
- fda_cyber: SA-1
- hitrust_csf: 01.a, 01.c
- iso_27799: 9.3, 9.4, H.5
- lloyds_ms: MS8.3
- naic_ds: 4-access, 4B
- nhs_dspt: NDG-4.1, NDG-4.3
- pra_ss1_23: P-IT.1
- solvency_ii: EIOPA-ICT-4.4
- owasp_masvs_v2: MASVS-AUTH-1, MASVS-AUTH-2, MASVS-AUTH-3
- csa_ccm_v4: IAM-10, IAM-13, IAM-14, IAM-15
- csa_aicm: IAM-10, IAM-13, IAM-14, IAM-15, IAM-17
- ccss_v9: 1.03.5, 1.04.1, 1.04.3, 1.05.1, 1.05.3
- mica: Art.40(1), Art.55(1), Art.63(1), Art.67(1), Art.72(1), Art.76(1)
- basel_sco60: SCO60.62, SCO60.66, SCO60.71
- bssc: GSP-11, KMS-06, NOS-05
- sec_custody_digital: SEC-CD-03, SEC-CD-05, SEC-CD-16
- dpdpa: Act.8(5), Rules.6(1)(b), Rules.Sch1.B.7
OSA's mapping for iso_27001_2022 and nist_csf_2 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/IA-02
- Clauses only: /api/v1/controls/IA-02?fields=mappings
- Page for people: /controls/ia-02/