IA-08 Identification and Authentication (Non-Organizational Users)
Identification and Authentication
Low Moderate High
Description
Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.
Supplemental Guidance
Non-organizational users include system users other than organizational users explicitly covered by IA-02. Non-organizational users are uniquely identified and authenticated for accesses other than those explicitly identified and documented in AC-14. Identification and authentication of non-organizational users accessing federal systems may be required to protect federal, proprietary, or privacy-related information.
Changes from Rev 4
No significant changes from Rev 4.
MITRE ATT&CK Techniques (22)
ATT&CK v16.1Techniques mitigated by this control, mapped via CTID.
Initial Access 1 Execution 5 Persistence 7 Privilege Escalation 3 Defense Evasion 4 Credential Access 1 Discovery 2 Lateral Movement 1 Collection 6 Exfiltration 1
Initial Access
Execution
Persistence
Privilege Escalation
Credential Access
Lateral Movement
Collection
Exfiltration
Compliance Mappings
ISO 27001:2022
A.5.16A.8.5
ISO 27002:2022
5.168.5
COBIT 2019
DSS05
NIST CSF 2.0
PR.AA-01PR.AA-03PR.AA-04
CSA CCM v4
IAM-14
CSA AICM v1
IAM-14
IEC 62443
3-3 SR 1.1
MAS TRM
9
BSI IT-Grundschutz
ORP.4
EU DORA
Art.9(4)(d)
BIO2
5.168.5
RBI CSF
Annex1.9
FISC Security Guidelines
FISC.T2
LGPD + BCB 4893
BCB.OpenFinanceBCB.PIX
HKMA TM-E-1
TME1.8.3
MLPS 2.0
8.1.4.1
DNB Good Practice
DNB.17.1
EU CRA
CRA.I.2d
SAMA CSF
3.1
NCA ECC
2-2
UAE IA
T9
CBB TM
TM-6
Qatar NIA
AC
CBUAE
CR-4
CBE CSF
CTO-1CTO-5
SA JS2
JS2-7.1JS2-8.1
CBN CSF
Part3.2Part5.2
BoG CISD
CISD-IXCISD-VIII
BoM CTRM
3.133.3
IOSCO Cyber Resilience
PROT-1
CPMI-IOSCO PFMI
CG.PR
FFIEC IS
II.C.15II.C.15(b)II.C.15(c)II.C.16
NYDFS 500
500.12
HIPAA Security Rule
§164.310(a)(2)(iii)§164.312(a)(2)(i)§164.312(d)
ECB CROE
CROE.2.3.1
EBA ICT Guidelines
3.4.23.8(b)
SEBI CSCRF
PR.AA
BOT Cyber Resilience
Ch2.2
CMMC 2.0
IA
NERC CIP
CIP-005-7
10 CFR 73.54
RG5.71-A-AC
TSA Pipeline SD
SD-2 Sec B
DOE C2M2 v2.1
ACCESS
API 1164
Sec 6
IAEA NSS 17-T
Sec 5.2
PCI HSM
9
Common Criteria
CC Part 2 — FIA
Solvency II
EIOPA-ICT-4.4
Lloyd's Minimum Standards
BP2.1MS8.3
NAIC Insurance Data Security
4-access
FCA SYSC 13
SYSC 13.7.3
FDA 21 CFR Part 11
§11.100(a)
FDA Cybersecurity Guidance
SA-1
ISO 27799
H.5
NHS DSPT
NDG-4.3
OWASP MASVS v2.1
MASVS-AUTH-1