[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fia-2":3},{"item":4,"lessons":18,"controls":68,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","ia-2","IA-2","Identification and Authentication (Organizational Users)",200,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Organisational users must be uniquely identified and authenticated, and that identity must be associated with processes acting on their behalf.\n\n**In practice.** This means every person has an individual account, shared logins are eliminated, and authentication runs through a central identity provider with single sign-on and multi-factor authentication, particularly for privileged, remote and cloud access. Auditors expect evidence of MFA coverage, lists of shared accounts with justification and configuration of the identity provider. CIS Controls 5 and 6 cover the same themes.\n\n**Common gaps.** Gaps include MFA exceptions that grow over time, legacy protocols that bypass MFA, and applications still using local accounts outside single sign-on. Shared administrator accounts remain common in operational technology and network devices.","Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.\nDiscussion: Organizations can satisfy the identification and authentication requirements by complying with the requirements in [HSPD 12](#f16e438e-7114-4144-bfe2-2dfcad8cb2d0) . Organizational users include employees or individuals who organizations consider to have an equivalent status to employees (e.g., contractors and guest researchers). Unique identification and authentication of users applies to all accesses other than those that are explicitly identified in [AC-14](#ac-14) and that occur through the authorized use of group authenticators without individual authentication. Since processes execute on behalf of groups and roles, organizations may require unique identification of individuals in group accounts or for detailed accountability of individual activity.\n\nOrganizations employ passwords, physical authenticators, or biometrics to authenticate user identities or, in the case of multi-factor authentication, some combination thereof. Access to organizational systems is defined as either local access or network access. Local access is any access to organizational systems by users or processes acting on behalf of users, where access is obtained through direct connections without the use of networks. Network access is access to organizational systems by users (or processes acting on behalf of users) where access is obtained through network connections (i.e., nonlocal accesses). Remote access is a type of network access that involves communication through external networks. Internal networks include local area networks and wide area networks.\n\nThe use of encrypted virtual private networks for network connections between organization-controlled endpoints and non-organization-controlled endpoints may be treated as internal networks with respect to protecting the confidentiality and integrity of information traversing the network. Identification and authentication requirements for non-organizational users are described in [IA-8](#ia-8).","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"deepfake-voice-cloning-exposes-gaps-in-identity-verification","Deepfake Voice Cloning Exposes Gaps in Identity Verification","2026-10-14T14:22:39.372+00:00",{"slug":25,"title":26,"published_at":27},"sap-cloud-sdk-flaw-exposes-oauth2-credentials-due-to-patch-regression","SAP Cloud SDK Flaw Exposes OAuth2 Credentials Due to Patch Regression","2026-10-13T20:22:04.987+00:00",{"slug":29,"title":30,"published_at":31},"swann-security-cameras-expose-live-feeds-due-to-missing-authentication","Swann Security Cameras Expose Live Feeds Due to Missing Authentication","2026-10-13T16:22:01.797+00:00",{"slug":33,"title":34,"published_at":35},"mfa-gaps-in-internal-systems-leave-the-door-open-for-ransomware","MFA Gaps in Internal Systems Leave the Door Open for Ransomware","2026-10-13T16:21:32.111+00:00",{"slug":37,"title":38,"published_at":39},"legitimate-tools-weaponized-teams-phishing-npm-worms-and-device-code-abuse","Legitimate Tools Weaponized: Teams Phishing, npm Worms, and Device-Code Abuse","2026-10-13T16:20:16.436+00:00",{"slug":41,"title":42,"published_at":43},"ai-agents-outpace-legacy-iam-the-non-human-identity-security-gap","AI Agents Outpace Legacy IAM: The Non-Human Identity Security Gap","2026-10-09T12:20:39.879+00:00",{"slug":45,"title":46,"published_at":47},"asos-breach-shows-social-engineering-remains-a-critical-human-vulnerability","ASOS Breach Shows Social Engineering Remains a Critical Human Vulnerability","2026-10-08T12:20:21.528+00:00",{"slug":49,"title":50,"published_at":51},"unauthorized-portal-access-exposes-400000-utility-customer-records","Unauthorized Portal Access Exposes 400,000 Utility Customer Records","2026-10-07T16:21:13.362+00:00",{"slug":53,"title":54,"published_at":55},"ai-bot-streaming-fraud-exposes-platform-detection-gaps","AI Bot Streaming Fraud Exposes Platform Detection Gaps","2026-10-07T12:20:57.58+00:00",{"slug":57,"title":58,"published_at":59},"critical-rce-flaw-in-swift-middleware-threatens-banking-government-systems","Critical RCE Flaw in SWIFT Middleware Threatens Banking & Government Systems","2026-10-02T18:21:48.948+00:00",{"slug":61,"title":62,"published_at":63},"dell-csm-max-severity-flaws-allow-unauthenticated-admin-takeover","Dell CSM Max-Severity Flaws Allow Unauthenticated Admin Takeover","2026-10-02T14:21:11.789+00:00",{"slug":65,"title":66,"published_at":67},"ai-agents-are-identities-too-govern-them-accordingly","AI Agents Are Identities Too — Govern Them Accordingly","2026-10-02T14:20:53.418+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",103,{"slug":75,"name":76,"problem":77,"stories":78},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",87,{"slug":80,"name":81,"problem":82,"stories":83},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",39,{"slug":85,"name":86,"problem":87,"stories":88},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",36,{"slug":90,"name":91,"problem":92,"stories":93},"patch-management","Automated patch management","Known holes get closed in days, not months.",35,{"slug":95,"name":96,"problem":97,"stories":98},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",32,[100,106,111,116,120,125,130,135],{"family":101,"item":102,"code":103,"title":104,"together":105},"cis","6","Control 6","Access Control Management",146,{"family":5,"item":107,"code":108,"title":109,"together":110},"ac-2","AC-2","Account Management",134,{"family":112,"item":113,"code":114,"title":115,"together":78},"gdpr","32","Article 32","Security of processing",{"family":101,"item":117,"code":118,"title":109,"together":119},"5","Control 5",63,{"family":101,"item":121,"code":122,"title":123,"together":124},"7","Control 7","Continuous Vulnerability Management",48,{"family":5,"item":126,"code":127,"title":128,"together":129},"ac-3","AC-3","Access Enforcement",47,{"family":5,"item":131,"code":132,"title":133,"together":134},"si-2","SI-2","Flaw Remediation",41,{"family":101,"item":136,"code":137,"title":138,"together":83},"14","Control 14","Security Awareness and Skills Training"]