Identification and Authentication (Organizational Users) IA-2
Identification and Authentication · Low baseline ✗ Not implemented
Status — program-wide
What references this control
No risks name this control in their Framework field yet.
No policies reference it yet.
Link a risk or policy to this control
Attaching adds IA-2 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.
Source: NIST SP 800-53 Rev.5, Identification and Authentication family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.
Control guide — plain-English, per NIST SP 800-53
IA-2 (Identification and Authentication) requires the system to uniquely identify and authenticate each organizational user - and the processes acting for them - before granting access. No shared logins. Rev 5 also requires multi-factor authentication (MFA) for access to privileged (IA-2(1)) and non-privileged (IA-2(2)) accounts across the Low, Moderate, and High baselines.
What good looks like
- Give every user a unique identity - no shared or generic accounts.
- Authenticate the user before any access is granted.
- Require MFA for access to privileged accounts (IA-2(1)) and non-privileged accounts (IA-2(2)) - Rev 5 places both in every baseline, Low and up.
- Use replay-resistant authentication mechanisms for account access (IA-2(8)).
Framework mapping
- NIST CSF 2.0 — PR.AA-03 — Users, services, and hardware are authenticated
- CIS Controls v8 — Control 6.5 — Require MFA for administrative and remote access
- OWASP Top 10:2021 — A07 Identification and Authentication Failures — Confirm each user's identity and use strong, multi-factor auth
How to move it toward Implemented
- The base control is met on VM 607: SSH (Secure Shell) is key-only (
PubkeyAuthentication yes,PasswordAuthentication no, §1c) and authenticates the uniquely named organizational user BLUEADMIN (§1a), with root login disabled - so every session maps to one real person. - The open item is the MFA enhancement (IA-2(1)/(2)), which Rev 5 requires for this MODERATE asset: a single SSH key is one factor. Add a second - for example a time-based one-time password (TOTP) via
pam_google_authenticatoror a hardware security key - so admin login needs key plus token. - Attach the sshd hardening file and the account inventory as asset-scoped evidence naming IA-2; that documents the base control while the MFA step is tracked as the remaining Plan of Action and Milestones (POA&M) item to fully satisfy the Moderate baseline.