THREATNOIR
Subscribe
NIST SP 800-53 Rev. 5 · IA-8

Identification and Authentication (Non-organizational Users)

US National Institute of Standards and Technology (NIST) · cited in 21 of our lessons

Explanation

What it asks for. Users who are not part of the organisation, such as customers, partners or members of the public, and processes acting for them, must be uniquely identified and authenticated.

In practice. This means customer and partner identity platforms with unique accounts, appropriate authentication strength for the risk of the service, and federation with partner identity providers where that makes sense. Auditors look for authentication configurations, account policies for external users and evidence that shared or anonymous access is limited to low-risk functions. Partner access should be time-limited and sponsored by a named internal owner.

Common gaps. Guest accounts in collaboration platforms accumulate and are rarely reviewed. Customer-facing services sometimes lack MFA options or protection against credential stuffing. External identities are also seldom included in access reviews.

Open SP 800-53 at NIST
The official text
Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users. Discussion: Non-organizational users include system users other than organizational users explicitly covered by [IA-2](#ia-2) . Non-organizational users are uniquely identified and authenticated for accesses other than those explicitly identified and documented in [AC-14](#ac-14) . Identification and authentication of non-organizational users accessing federal systems may be required to protect federal, proprietary, or privacy-related information (with exceptions noted for national security systems). Organizations consider many factors—including security, privacy, scalability, and practicality—when balancing the need to ensure ease of use for access to federal information and systems with the need to protect and adequately mitigate risk.

From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.

Lessons that cite it

Real incidents where this item mattered: the latest 12 of 21.