# IA-08 Identification and Authentication (Non-organizational Users)

NIST SP 800-53 control. Family: IA Identification and Authentication. Function: preventative. Baselines: low, moderate, high. Mapping licence: CC BY-SA 4.0.

Statement: Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.
Guidance: Non-organizational users include system users other than organizational users explicitly covered by IA-2. Non-organizational users are uniquely identified and authenticated for accesses other than those explicitly identified and documented in AC-14. Identification and authentication of non-organizational users accessing federal systems may be required to protect federal, proprietary, or privacy-related information (with exceptions noted for national security systems). Organizations consider many factors—including security, privacy, scalability, and practicality—when balancing the need to ensure ease of use for access to federal information and systems with the need to protect and adequately mitigate risk.

## Enhancements (5)
- IA-08(01) Acceptance of PIV Credentials from Other Agencies. Baselines: low, moderate, high
- IA-08(02) Acceptance of External Authenticators. Baselines: low, moderate, high
- IA-08(04) Use of Defined Profiles. Baselines: low, moderate, high
- IA-08(05) Acceptance of PIV-I Credentials
- IA-08(06) Disassociability
Withdrawn by NIST: IA-08(03) (now in IA-08(02)).
Each enhancement's statement: /api/v1/controls/IA-08?fields=enhancements

## Patterns that use it (8)
- Critical (3): SP-032 Modern Authentication; SP-044 SaaS Identity Lifecycle Management; SP-052 Decentralised Identity & Verifiable Credentials (draft)
- Important (5): SP-028 Secure DevOps Pipeline Pattern; SP-029 Zero Trust Architecture; SP-030 API Security; SP-047 Secure Agentic AI Frameworks; SP-054 CBDC and Digital Currency Infrastructure (draft)

## Clauses by framework (56 frameworks)
- iso_27001_2022: A.5.16, A.8.5. OSA's own, not in NIST's crosswalk: A.8.5
- iso_27002_2022: 5.16, 8.5
- cobit_2019: DSS05
- nist_csf_2: PR.AA-01, PR.AA-03, PR.AA-04. OSA's own, not in NIST's crosswalk: PR.AA-04
- iec_62443: 3-3 SR 1.1
- mas_trm: 9
- bsi_grundschutz: ORP.4
- dora: Art.9(4)(d)
- bio2: 5.16, 8.5
- rbi_csf: Annex1.9
- fisc: FISC.T2
- lgpd_bcb: BCB.OpenFinance, BCB.PIX
- hkma_tme1: TME1.8.3
- mlps_2: 8.1.4.1
- dnb_good_practice: DNB.17.1
- cra: CRA.I.2d
- cbb_tm: TM-6
- cbuae: CR-4
- nca_ecc: 2-2
- qatar_nia: AC
- sama_csf: 3.1
- uae_ia: T9
- bog_cisd: CISD-IX, CISD-VIII
- bom_ctrm: 3.3, 3.13
- cbe_csf: CTO-1, CTO-5
- cbn_csf: Part3.2, Part5.2
- sa_js2: JS2-7.1, JS2-8.1
- bot_cyber: Ch2.2
- cpmi_pfmi: CG.PR
- eba_ict: 3.4.2, 3.8(b)
- ecb_croe: CROE.2.3.1
- ffiec_is: II.C.15, II.C.15(b), II.C.15(c), II.C.16
- hipaa_sr: §164.310(a)(2)(iii), §164.312(a)(2)(i), §164.312(d)
- iosco_cyber: PROT-1
- nydfs_500: 500.12
- sebi_cscrf: PR.AA
- cmmc_2: IA
- nerc_cip: CIP-005-7
- nrc_73_54: RG5.71-A-AC
- tsa_psd: SD-2 Sec B
- doe_c2m2: ACCESS
- api_1164: Sec 6
- iaea_nss: Sec 5.2
- pci_hsm: 9
- common_criteria: CC Part 2 — FIA
- fca_sysc_13: SYSC 13.7.3
- fda_21_cfr_11: §11.100(a)
- fda_cyber: SA-1
- iso_27799: H.5
- lloyds_ms: BP2.1, MS8.3
- naic_ds: 4-access
- nhs_dspt: NDG-4.3
- solvency_ii: EIOPA-ICT-4.4
- owasp_masvs_v2: MASVS-AUTH-1
- csa_ccm_v4: IAM-14
- csa_aicm: IAM-14
OSA's mapping for iso_27001_2022 and nist_csf_2 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/IA-08
- Clauses only: /api/v1/controls/IA-08?fields=mappings
- Page for people: /controls/ia-08/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.