ComplianceNIST 800-53 control

NIST-IA-8 Identification and Authentication (Non-organizational Users)

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
IA Identification and Authentication
Control
IA-8
ATT&CK techniques mitigated
22

Control statement

Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.

Discussion

Non-organizational users include system users other than organizational users explicitly covered by [IA-2](#ia-2) . Non-organizational users are uniquely identified and authenticated for accesses other than those explicitly identified and documented in [AC-14](#ac-14) . Identification and authentication of non-organizational users accessing federal systems may be required to protect federal, proprietary, or privacy-related information (with exceptions noted for national security systems). Organizations consider many factors—including security, privacy, scalability, and practicality—when balancing the need to ensure ease of use for access to federal information and systems with the need to protect and adequately mitigate risk.

ATT&CK mappings (CTID)

• T1053 Scheduled Task/Job • T1053.007 Container Orchestration Job • T1059 Command and Scripting Interpreter • T1059.001 PowerShell • T1059.008 Network Device CLI • T1087.004 Cloud Account • T1190 Exploit Public-Facing Application • T1210 Exploitation of Remote Services • T1213 Data from Information Repositories • T1213.001 Confluence • T1213.002 Sharepoint • T1213.004 Customer Relationship Management Software • T1213.005 Messaging Applications • T1528 Steal Application Access Token • T1530 Data from Cloud Storage • T1537 Transfer Data to Cloud Account • T1538 Cloud Service Dashboard • T1542 Pre-OS Boot • T1542.001 System Firmware • T1542.003 Bootkit • T1542.005 TFTP Boot • T1547.006 Kernel Modules and Extensions

Related

Mitigates · MITRE ATT&CK (22)

  • T1213.005 Messaging Applications sub-technique
  • T1213.004 Customer Relationship Management Software sub-technique
  • T1053.007 Container Orchestration Job sub-technique
  • T1059.008 Network Device CLI sub-technique
  • T1542.005 TFTP Boot sub-technique
  • T1059.001 PowerShell sub-technique
  • T1087.004 Cloud Account sub-technique
  • T1213.001 Confluence sub-technique
  • T1213.002 Sharepoint sub-technique
  • T1547.006 Kernel Modules and Extensions sub-technique
  • T1542.001 System Firmware sub-technique
  • T1542.003 Bootkit sub-technique
  • T1542 Pre-OS Boot technique
  • T1528 Steal Application Access Token technique
  • T1530 Data from Cloud Storage technique
  • T1537 Transfer Data to Cloud Account technique
  • T1538 Cloud Service Dashboard technique
  • T1190 Exploit Public-Facing Application technique
  • T1210 Exploitation of Remote Services technique
  • T1213 Data from Information Repositories technique
  • T1053 Scheduled Task/Job technique
  • T1059 Command and Scripting Interpreter technique

Related control · Compliance (16)

  • NIST-AC-14 Permitted Actions Without Identification or Authentication NIST 800-53 control
  • NIST-AC-17 Remote Access NIST 800-53 control
  • NIST-AC-18 Wireless Access NIST 800-53 control
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-AU-6 Audit Record Review, Analysis, and Reporting NIST 800-53 control
  • NIST-IA-10 Adaptive Authentication NIST 800-53 control
  • NIST-IA-11 Re-authentication NIST 800-53 control
  • NIST-IA-13 Identity Providers and Authorization Servers NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-4 Identifier Management NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-MA-4 Nonlocal Maintenance NIST 800-53 control
  • NIST-RA-3 Risk Assessment NIST 800-53 control
  • NIST-SA-4 Acquisition Process NIST 800-53 control
  • NIST-SC-8 Transmission Confidentiality and Integrity NIST 800-53 control

Referenced by Compliance · enhancement of (5)

  • NIST-IA-8(1) Acceptance of PIV Credentials from Other Agencies NIST 800-53 enhancement
  • NIST-IA-8(2) Acceptance of External Authenticators NIST 800-53 enhancement
  • NIST-IA-8(4) Use of Defined Profiles NIST 800-53 enhancement
  • NIST-IA-8(5) Acceptance of PIV-I Credentials NIST 800-53 enhancement
  • NIST-IA-8(6) Disassociability NIST 800-53 enhancement

Referenced by Compliance · has member (1)

  • NIST-IA Identification and Authentication NIST 800-53 family

Referenced by Compliance · related control (24)

  • NIST-AC-17 Remote Access NIST 800-53 control
  • NIST-AC-18 Wireless Access NIST 800-53 control
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3(14) Individual Access NIST 800-53 enhancement
  • NIST-AC-6(6) Privileged Access by Non-organizational Users NIST 800-53 enhancement
  • NIST-AU-16(1) Identity Preservation NIST 800-53 enhancement
  • NIST-AU-6 Audit Record Review, Analysis, and Reporting NIST 800-53 control
  • NIST-IA-10 Adaptive Authentication NIST 800-53 control
  • NIST-IA-11 Re-authentication NIST 800-53 control
  • NIST-IA-12 Identity Proofing NIST 800-53 control
  • NIST-IA-12(6) Accept Externally-proofed Identities NIST 800-53 enhancement
  • NIST-IA-13 Identity Providers and Authorization Servers NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-4 Identifier Management NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-MA-4 Nonlocal Maintenance NIST 800-53 control
  • NIST-MA-5 Maintenance Personnel NIST 800-53 control
  • NIST-PE-3 Physical Access Control NIST 800-53 control
  • NIST-RA-3 Risk Assessment NIST 800-53 control
  • NIST-SA-4(10) Use of Approved PIV Products NIST 800-53 enhancement
  • NIST-SC-45 System Time Synchronization NIST 800-53 control
  • NIST-SC-8 Transmission Confidentiality and Integrity NIST 800-53 control
  • NIST-SR-4(1) Identity NIST 800-53 enhancement
  • NIST-SR-4(2) Track and Trace NIST 800-53 enhancement