BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

IA-04(01) Prohibit Account Identifiers as Public Identifiers

NIST SP 800-53 (controls) 5.1.1+u4
All changes in this version
first version loaded IA part of IA-4

Title

Prohibit Account Identifiers as Public Identifiers

Control

Prohibit the use of system account identifiers that are the same as public identifiers for individual accounts.

Discussion

Prohibiting account identifiers as public identifiers applies to any publicly disclosed account identifier used for communication such as, electronic mail and instant messaging. Prohibiting the use of systems account identifiers that are the same as some public identifier, such as the individual identifier section of an electronic mail address, makes it more difficult for adversaries to guess user identifiers. Prohibiting account identifiers as public identifiers without the implementation of other supporting controls only complicates guessing of identifiers. Additional protections are required for authenticators and credentials to protect the account.

Related controls

at-2, pt-7

Assessment objective

IA-04(01) the use of system account identifiers that are the same as public identifiers is prohibited for individual accounts.

STIG rules that implement this control 0

No followed STIG rule cites a CCI indexed to this control (CCI list 2026-07-14).