# IA-09 Service Identification and Authentication

NIST SP 800-53 control. Family: IA Identification and Authentication. Function: preventative. In no baseline. Mapping licence: CC BY-SA 4.0.

Statement: Uniquely identify and authenticate [Assignment: organization-defined system services and applications] before establishing communications with devices, users, or other services or applications.
Guidance: Services that may require identification and authentication include web applications using digital certificates or services or applications that query a database. Identification and authentication methods for system services and applications include information or code signing, provenance graphs, and electronic signatures that indicate the sources of services. Decisions regarding the validity of identification and authentication claims can be made by services separate from the services acting on those decisions. This can occur in distributed system architectures. In such situations, the identification and authentication decisions (instead of actual identifiers and authentication data) are provided to the services that need to act on those decisions.

## Enhancements (none current)
Withdrawn by NIST: IA-09(01) (now in IA-09); IA-09(02) (now in IA-09).

## Patterns that use it (4)
- Critical (1): SP-030 API Security
- Important (2): SP-032 Modern Authentication; SP-046 External Attack Surface Management
- Standard (1): SP-044 SaaS Identity Lifecycle Management

## Clauses by framework (21 frameworks)
- cobit_2019: DSS05
- nist_csf_2: PR.AA-01, PR.AA-03
- iec_62443: 3-3 SR 1.2
- mas_trm: 9
- bsi_grundschutz: ORP.4
- rbi_csf: Annex1.11
- hkma_tme1: TME1.9.3
- cbuae: CR-4
- nca_ecc: 5-1
- qatar_nia: AC
- sama_csf: 3.1
- uae_ia: T9
- bom_ctrm: 3.3
- cbe_csf: CTO-1
- bot_cyber: Ch2.2
- hipaa_sr: §164.312(d)
- cmmc_2: IA
- ferc_cip: Order 2222
- common_criteria: CC Part 2 — FIA
- fda_21_cfr_11: §11.10(h)
- fda_cyber: SA-1
OSA's mapping for nist_csf_2 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/IA-09
- Clauses only: /api/v1/controls/IA-09?fields=mappings
- Page for people: /controls/ia-09/