IA-02 Identification and Authentication (Organizational Users)
All changes in this version
Title
Identification and Authentication (Organizational Users)
Control
Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.
Discussion
Organizations can satisfy the identification and authentication requirements by complying with the requirements in [HSPD 12](#f16e438e-7114-4144-bfe2-2dfcad8cb2d0) . Organizational users include employees or individuals who organizations consider to have an equivalent status to employees (e.g., contractors and guest researchers). Unique identification and authentication of users applies to all accesses other than those that are explicitly identified in [AC-14](#ac-14) and that occur through the authorized use of group authenticators without individual authentication. Since processes execute on behalf of groups and roles, organizations may require unique identification of individuals in group accounts or for detailed accountability of individual activity.
Organizations employ passwords, physical authenticators, or biometrics to authenticate user identities or, in the case of multi-factor authentication, some combination thereof. Access to organizational systems is defined as either local access or network access. Local access is any access to organizational systems by users or processes acting on behalf of users, where access is obtained through direct connections without the use of networks. Network access is access to organizational systems by users (or processes acting on behalf of users) where access is obtained through network connections (i.e., nonlocal accesses). Remote access is a type of network access that involves communication through external networks. Internal networks include local area networks and wide area networks.
The use of encrypted virtual private networks for network connections between organization-controlled endpoints and non-organization-controlled endpoints may be treated as internal networks with respect to protecting the confidentiality and integrity of information traversing the network. Identification and authentication requirements for non-organizational users are described in [IA-8](#ia-8).
Related controls
ac-14, ac-17, ac-18, ac-2, ac-3, ac-4, au-1, au-6, ia-13, ia-4, ia-5, ia-8, ma-4, ma-5, pe-2, pl-4, sa-4, sa-8
STIG rules that implement this control 27
Apple iOS/iPadOS 26 V1R3
- AIOS-26-011300 CAT II Apple iOS/iPadOS 26 must implement the management setting: use SSL for Exchange ActiveSync.
- AIOS-26-011400 CAT II Apple iOS/iPadOS 26 must implement the management setting: not allow messages in an ActiveSync Exchange account to be forwarded or moved to other accounts in the Apple iOS/iPadOS 26 Mail app.
Apple iOS/iPadOS 27 V1R1
- AIOS-27-010500 CAT II Apple iOS/iPadOS 27 must implement the management setting: use SSL for Exchange ActiveSync.
- AIOS-27-010600 CAT II Apple iOS/iPadOS 27 must implement the management setting: not allow messages in an ActiveSync Exchange account to be forwarded or moved to other accounts in the Apple iOS/iPadOS 27 Mail app.
Apple macOS 15 (Sequoia) V1R8
- APPL-15-000090 CAT II The macOS system must disable login to other users' active and locked sessions.
- APPL-15-000100 CAT II The macOS system must disable root login.
- APPL-15-002066 CAT I The macOS system must disable unattended or automatic login to the system.
- APPL-15-005052 CAT II The macOS system must configure the login window to prompt for username and password.
Apple macOS 26 (Tahoe) V1R4
- APPL-26-000090 CAT II The macOS system must disable login to other users' active and locked sessions.
- APPL-26-000100 CAT II The macOS system must disable root login.
- APPL-26-002066 CAT I The macOS system must disable unattended or automatic login to the system.
- APPL-26-005052 CAT II The macOS system must configure the login window to prompt for username and password.
Application Security and Development V6R5
- APSC-DV-001540 CAT I The application must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-411015 CAT II Ubuntu 22.04 LTS must uniquely identify interactive users.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-400000 CAT II Ubuntu 24.04 LTS must uniquely identify interactive users.
Microsoft Windows Server 2022 V2R11
- WN22-00-000070 CAT II Windows Server 2022 shared user accounts must not be permitted.
- WN22-00-000200 CAT II Windows Server 2022 accounts must require passwords.
Microsoft Windows Server 2025 V1R4
- WN25-00-000070 CAT II Windows Server 2025 shared user accounts must not be permitted.
- WN25-00-000200 CAT II Windows Server 2025 accounts must require passwords.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-200621 CAT II RHEL 10 must use the common access card (CAC) smart card driver.
- RHEL-10-600130 CAT II RHEL 10 must not allow duplicate user IDs (UIDs) to exist for interactive users.
- RHEL-10-600150 CAT II RHEL 10 must assign a primary group to all interactive users.
- RHEL-10-600470 CAT II RHEL 10 must have a unique group ID (GID) for each group in "/etc/group".
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-411030 CAT II RHEL 9 duplicate User IDs (UIDs) must not exist for interactive users.
- RHEL-09-411045 CAT II All RHEL 9 interactive users must have a primary group that exists.
- RHEL-09-411110 CAT II RHEL 9 groups must have unique Group ID (GID).
- RHEL-09-611160 CAT II RHEL 9 must use the common access card (CAC) smart card driver.