NIST SP 800-53 Rev 5 LOW IA-2: Identification and Authentication (Organizational Users)

What else in your programme already covers this

This control maps to 47 controls across 24 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

CIS Controls v8 · 5 controls

CIS-5.1 Establish and Maintain an Inventory of Accounts
CIS-6.3 Require MFA for Externally-Exposed Applications
CIS-6.4 Require MFA for Remote Network Access
CIS-6.5 Require MFA for Administrative Access
CIS-6.7 Centralize Access Control

PCI DSS 4.0 · 4 controls

8.2.1 All users are assigned a unique ID before access to system components or cardholder data is allowed
8.2.4 Addition, deletion, and modification of user IDs, authentication factors, and other identifier objects are managed as follows: • Authorized with the appropriate approval. • Implemented with only the privileges specified on the documented approval
8.3.1 All user access to system components for users and administrators is authenticated via at least one of the following authentication factors: • Something you know, such as a password or passphrase. • Something you
8.4.2 MFA is implemented for all non-console access into the CDE

Azure Security Benchmark · 3 controls

ASBv3-IM-5 Use single sign-on (SSO) for application access
IM-1 Use centralized identity and authentication system
IM-6 Use strong authentication controls

CMMC 2.0 · 3 controls

AU.L2-3.3.2 User Accountability
IA.L2-3.5.1 Identification
IA.L2-3.5.2 Authentication

ISO 27002:2022 · 3 controls

5.16 Identity management
5.17 Authentication information
8.5 Secure authentication

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 2 controls

ANSSI-HYG-08 Identify Each Person by Name and Separate User and Administrator Roles
ANSSI-HYG-13 Prefer Strong Authentication Where Possible

ASD Strategies to Mitigate Cyber Security Incidents · 2 controls

ASD37-20 Multi-factor authentication (Essential)
ASD37-21 Disable local administrator accounts (Excellent)

C5 (Germany) · 2 controls

C5-IDM-09 Authentication mechanisms
C5-PSS-05 Authentication Mechanisms

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

CCM-IAM-13 Uniquely Identifiable Users
CCM-IAM-14 Strong Authentication

HIPAA Security Rule · 2 controls

164.312(a)(2)(i) Unique User Identification (Required)
164.312(d) Person or Entity Authentication (Standard)

ISO 27001:2022 · 2 controls

5.16 Identity management
8.5 Secure authentication

NIST Cybersecurity Framework 2.0 · 2 controls

NIST-CSF-PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization
NIST-CSF-PR.AA-03 Users, services, and hardware are authenticated

NIST SP 800-66 Rev 2 · 2 controls

164.312(a)(2)(i) Unique User Identification (Required)
164.312(d) Person or Entity Authentication (Standard)

SOC 2 · 2 controls

SOC2-CC6.1 Implements logical access security software, infrastructure and architectures over protected information assets
SOC2-CC6.2 Prior to granting access, registration and authorization processes are established

UK Cyber Essentials · 2 controls

CE-AC.2 Authenticate Users Before Granting Access
CE-SC.4 Authenticate Users Before Access

ACSC Essential Eight · 1 control

E8-MFA-ML2 Multi-Factor Authentication - Maturity Level 2

AWS Well-Architected Security Pillar · 1 control

SEC02-BP04 Rely on a centralized identity provider

Australia Consumer Data Right - Banking (CDR) · 1 control

AUCDR-IS-1 Limit risk of unauthorised access to the CDR data environment

Australia My Health Records Act 2012 · 1 control

MYHR-REG-11 Ensuring required information is given to the System Operator

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

CFTC-SS-3 Information Security Category

NIST SP 800-161 Rev 1 · 1 control

161R1-IA-2 Identification and Authentication (Organizational Users)

NIST SP 800-171 Rev 3 · 1 control

03.05.01 User Identification and Authentication

NIST SP 800-172 · 1 control

3.5.3e Prohibit Connection of Unknown or Unverified System Components

NIST SP 800-53 Rev 5 · 1 control

NIST800-IA-2 Identification and authentication of organizational users

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.