IA-08 Identification and Authentication (Non-organizational Users)
Identification and Authentication
Description
Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.
Supplemental Guidance
Non-organizational users include system users other than organizational users explicitly covered by IA-2. Non-organizational users are uniquely identified and authenticated for accesses other than those explicitly identified and documented in AC-14. Identification and authentication of non-organizational users accessing federal systems may be required to protect federal, proprietary, or privacy-related information (with exceptions noted for national security systems). Organizations consider many factors—including security, privacy, scalability, and practicality—when balancing the need to ensure ease of use for access to federal information and systems with the need to protect and adequately mitigate risk.
Changes from Rev 4
No significant changes from Rev 4.
Enhancements (5)
What NIST adds to this control. Select one to read its statement.
IA-08(01) Acceptance of PIV Credentials from Other Agencies LowModerateHigh
Accept and electronically verify Personal Identity Verification-compliant credentials from other federal agencies.
IA-08(02) Acceptance of External Authenticators LowModerateHigh
a. Accept only external authenticators that are NIST-compliant; and b. Document and maintain a list of accepted external authenticators.
IA-08(04) Use of Defined Profiles LowModerateHigh
Conform to the following profiles for identity management [Assignment: organization-defined identity management profiles].
IA-08(05) Acceptance of PIV-I Credentials
Accept and verify federated or PKI credentials that meet [Assignment: organization-defined policy].
IA-08(06) Disassociability
Implement the following measures to disassociate user attributes or identifier assertion relationships among individuals, credential service providers, and relying parties: [Assignment: organization-defined measures].
Withdrawn by NIST:
- IA-08(03) Use of FICAM-approved Products, now in IA-08(02)
Patterns that use this control (8)
Grouped by the emphasis each pattern gives it.
Critical (3)
MITRE ATT&CK Techniques (22)
ATT&CK v16.1Techniques mitigated by this control, mapped via CTID.