id: "IA-02" title: "Identification and Authentication (Organizational Users)" family: "IA" family_name: "Identification and Authentication" sort_id: "ia-02" priority: "P1" implementation_level: "system" enhancements: - ia-2.1 - ia-2.2 - ia-2.3 - ia-2.4 - ia-2.5 - ia-2.6 - ia-2.7 - ia-2.8 - ia-2.9 - ia-2.10 - ia-2.11 - ia-2.12 - ia-2.13
Statement
Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.
Guidance
Organizations can satisfy the identification and authentication requirements by complying with the requirements in HSPD 12 . Organizational users include employees or individuals who organizations consider to have an equivalent status to employees (e.g., contractors and guest researchers). Unique identification and authentication of users applies to all accesses other than those that are explicitly identified in AC-14 and that occur through the authorized use of group authenticators without individual authentication. Since processes execute on behalf of groups and roles, organizations may require unique identification of individuals in group accounts or for detailed accountability of individual activity.
Organizations employ passwords, physical authenticators, or biometrics to authenticate user identities or, in the case of multi-factor authentication, some combination thereof. Access to organizational systems is defined as either local access or network access. Local access is any access to organizational systems by users or processes acting on behalf of users, where access is obtained through direct connections without the use of networks. Network access is access to organizational systems by users (or processes acting on behalf of users) where access is obtained through network connections (i.e., nonlocal accesses). Remote access is a type of network access that involves communication through external networks. Internal networks include local area networks and wide area networks.
The use of encrypted virtual private networks for network connections between organization-controlled endpoints and non-organization-controlled endpoints may be treated as internal networks with respect to protecting the confidentiality and integrity of information traversing the network. Identification and authentication requirements for non-organizational users are described in IA-8.
Assessment Objective: organizational users are uniquely identified and authenticated;
Assessment Objective: the unique identification of authenticated organizational users is associated with processes acting on behalf of those users.
Identification and authentication policy
procedures addressing user identification and authentication
system security plan, system design documentation
system configuration settings and associated documentation
system audit records
list of system accounts
other relevant documents or records
Organizational personnel with system operations responsibilities
organizational personnel with information security responsibilities
system/network administrators
organizational personnel with account management responsibilities
system developers
Organizational processes for uniquely identifying and authenticating users
mechanisms supporting and/or implementing identification and authentication capabilities