IA-08 Identification and Authentication (Non-organizational Users)
All changes in this version
Title
Identification and Authentication (Non-organizational Users)
Control
Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.
Discussion
Non-organizational users include system users other than organizational users explicitly covered by [IA-2](#ia-2) . Non-organizational users are uniquely identified and authenticated for accesses other than those explicitly identified and documented in [AC-14](#ac-14) . Identification and authentication of non-organizational users accessing federal systems may be required to protect federal, proprietary, or privacy-related information (with exceptions noted for national security systems). Organizations consider many factors—including security, privacy, scalability, and practicality—when balancing the need to ensure ease of use for access to federal information and systems with the need to protect and adequately mitigate risk.
Related controls
ac-14, ac-17, ac-18, ac-2, ac-6, au-6, ia-10, ia-11, ia-13, ia-2, ia-4, ia-5, ma-4, ra-3, sa-4, sc-8
Assessment objective
IA-08 non-organizational users or processes acting on behalf of non-organizational users are uniquely identified and authenticated.
STIG rules that implement this control 9
Application Security and Development V6R5
- APSC-DV-001870 CAT II The application must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-411015 CAT II Ubuntu 22.04 LTS must uniquely identify interactive users.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-400000 CAT II Ubuntu 24.04 LTS must uniquely identify interactive users.
Microsoft Windows 11 V2R11
- WN11-00-000032 CAT II Windows 11 systems must use a BitLocker PIN with a minimum length of six digits for pre-boot authentication.
- WN11-SO-000010 CAT II The built-in guest account must be disabled.
Microsoft Windows Server 2022 V2R11
- WN22-SO-000010 CAT II Windows Server 2022 must have the built-in guest account disabled.
Microsoft Windows Server 2025 V1R4
- WN25-SO-000010 CAT II Windows Server 2025 must have the built-in guest account disabled.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-600130 CAT II RHEL 10 must not allow duplicate user IDs (UIDs) to exist for interactive users.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-411030 CAT II RHEL 9 duplicate User IDs (UIDs) must not exist for interactive users.