[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fia-8":3},{"item":4,"lessons":18,"controls":68,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","ia-8","IA-8","Identification and Authentication (Non-organizational Users)",21,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Users who are not part of the organisation, such as customers, partners or members of the public, and processes acting for them, must be uniquely identified and authenticated.\n\n**In practice.** This means customer and partner identity platforms with unique accounts, appropriate authentication strength for the risk of the service, and federation with partner identity providers where that makes sense. Auditors look for authentication configurations, account policies for external users and evidence that shared or anonymous access is limited to low-risk functions. Partner access should be time-limited and sponsored by a named internal owner.\n\n**Common gaps.** Guest accounts in collaboration platforms accumulate and are rarely reviewed. Customer-facing services sometimes lack MFA options or protection against credential stuffing. External identities are also seldom included in access reviews.","Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.\nDiscussion: Non-organizational users include system users other than organizational users explicitly covered by [IA-2](#ia-2) . Non-organizational users are uniquely identified and authenticated for accesses other than those explicitly identified and documented in [AC-14](#ac-14) . Identification and authentication of non-organizational users accessing federal systems may be required to protect federal, proprietary, or privacy-related information (with exceptions noted for national security systems). Organizations consider many factors—including security, privacy, scalability, and practicality—when balancing the need to ensure ease of use for access to federal information and systems with the need to protect and adequately mitigate risk.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"ai-powered-android-defenses-target-voice-cloning-and-messaging-scams","AI-Powered Android Defenses Target Voice Cloning and Messaging Scams","2026-10-15T20:20:20.548+00:00",{"slug":25,"title":26,"published_at":27},"critical-citrix-netscaler-rce-flaw-demands-immediate-patching-in-saml-deployments","Critical Citrix NetScaler RCE Flaw Demands Immediate Patching in SAML Deployments","2026-10-09T10:22:22.802+00:00",{"slug":29,"title":30,"published_at":31},"rogue-mfa-providers-can-intercept-credentials-via-entra-trust-abuse","Rogue MFA Providers Can Intercept Credentials via Entra Trust Abuse","2026-09-22T22:20:19.316+00:00",{"slug":33,"title":34,"published_at":35},"sms-based-mfa-retirement-demands-urgent-migration-to-phishing-resistant-auth","SMS-Based MFA Retirement Demands Urgent Migration to Phishing-Resistant Auth","2026-09-21T14:20:26.775+00:00",{"slug":37,"title":38,"published_at":39},"mfa-is-not-enough-oauth-consent-abuse-bypasses-authentication-controls","MFA Is Not Enough: OAuth Consent Abuse Bypasses Authentication Controls","2026-09-18T20:20:44.491+00:00",{"slug":41,"title":42,"published_at":43},"siemens-mendix-saml-flaw-enables-unauthenticated-account-hijacking","Siemens Mendix SAML Flaw Enables Unauthenticated Account Hijacking","2026-09-15T17:21:59.973+00:00",{"slug":45,"title":46,"published_at":47},"it-support-impersonation-via-teams-leads-to-enterprise-wide-compromise","IT Support Impersonation via Teams Leads to Enterprise-Wide Compromise","2026-09-03T04:20:19.789+00:00",{"slug":49,"title":50,"published_at":51},"third-party-email-verification-flaw-enables-dropbox-account-takeovers","Third-Party Email Verification Flaw Enables Dropbox Account Takeovers","2026-09-02T14:21:17.887+00:00",{"slug":53,"title":54,"published_at":55},"critical-wordpress-saml-plugin-flaws-enable-unauthenticated-admin-takeover","Critical WordPress SAML Plugin Flaws Enable Unauthenticated Admin Takeover","2026-08-25T10:21:10.387+00:00",{"slug":57,"title":58,"published_at":59},"miniorange-saml-plugin-auth-bypass-exposes-wordpress-admin-access","miniOrange SAML Plugin Auth Bypass Exposes WordPress Admin Access","2026-08-24T20:20:24.325+00:00",{"slug":61,"title":62,"published_at":63},"belgium-eid-browser-extension-vulnerabilities-enable-rce-and-account-takeover","Belgium eID Browser Extension Vulnerabilities Enable RCE and Account Takeover","2026-08-13T08:20:21.607+00:00",{"slug":65,"title":66,"published_at":67},"passkey-attacks-bypass-phishing-resistant-mfa-without-breaking-cryptography","Passkey Attacks Bypass Phishing-Resistant MFA Without Breaking Cryptography","2026-08-10T14:21:05.845+00:00",[69,74,79,84,89,93],{"slug":70,"name":71,"problem":72,"stories":73},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",13,{"slug":75,"name":76,"problem":77,"stories":78},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",12,{"slug":80,"name":81,"problem":82,"stories":83},"patch-management","Automated patch management","Known holes get closed in days, not months.",5,{"slug":85,"name":86,"problem":87,"stories":88},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",4,{"slug":90,"name":91,"problem":92,"stories":88},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":94,"name":95,"problem":96,"stories":88},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[98,104,110,114,120,124,129,133],{"family":99,"item":100,"code":101,"title":102,"together":103},"gdpr","32","Article 32","Security of processing",17,{"family":105,"item":106,"code":107,"title":108,"together":109},"cis","6","Control 6","Access Control Management",14,{"family":5,"item":111,"code":112,"title":113,"together":78},"ac-2","AC-2","Account Management",{"family":115,"item":116,"code":117,"title":118,"together":119},"nist-sp","800-63","SP 800-63","SP 800-63: Digital Identity Guidelines",11,{"family":105,"item":121,"code":122,"title":113,"together":123},"5","Control 5",9,{"family":105,"item":125,"code":126,"title":127,"together":128},"7","Control 7","Continuous Vulnerability Management",8,{"family":130,"item":131,"code":132,"title":132,"together":128},"itil","overview","ITIL",{"family":105,"item":134,"code":135,"title":136,"together":137},"4","Control 4","Secure Configuration of Enterprise Assets and Software",7]