Frameworks / NIST SP 800-53 Rev 5 / NIST800-IA-2 What else in your programme already covers this This control maps to 113 controls across 36 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
AC-6(1) Authorize Access to Security Functions IA-2 Identification and Authentication (Organizational Users) IA-2(1) MFA to Privileged Accounts IA-2(12) Acceptance of PIV Credentials IA-2(2) MFA to Non-Privileged Accounts IA-2(5) Identification and Authentication (Organizational Users) | Individual Authentication with Group Authentication (IA-2(5)) IA-2(6) Identification and Authentication (Organizational Users) | Access to Accounts: separate Device (IA-2(6)) IA-2(8) Access to Accounts Replay Resistant IA-5(2) Public Key-Based Authentication RA-5(5) Privileged Access AC-6(1) Authorize Access to Security Functions IA-2 Identification and Authentication (Organizational Users) IA-2(1) MFA to Privileged Accounts IA-2(12) Acceptance of PIV Credentials IA-2(2) MFA to Non-Privileged Accounts IA-2(5) Identification and Authentication (Organizational Users) | Individual Authentication with Group Authentication (IA-2(5)) IA-2(6) Identification and Authentication (Organizational Users) | Access to Accounts: separate Device (IA-2(6)) IA-2(8) Access to Accounts Replay Resistant IA-5(2) Public Key-Based Authentication RA-5(5) Privileged Access CIS-5.1 Establish and Maintain an Inventory of Accounts CIS-5.2 Use Unique Passwords CIS-5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts CIS-6.3 Require MFA for Externally-Exposed Applications CIS-6.4 Require MFA for Remote Network Access CIS-6.5 Require MFA for Administrative Access 5.15 Access control 5.16 Identity management 5.17 Authentication information 6.7 Remote working 8.2 Privileged access rights 8.5 Secure authentication 8.2.1 8.2.1 Unique ID assigned to every user 8.2.2 8.2.2 Shared and generic IDs only by exception 8.3.1 8.3.1 Access authenticated with at least one factor 8.4.1 8.4.1 MFA for non-console administrative CDE access 8.4.2 8.4.2 MFA for all non-console CDE access 8.4.3 8.4.3 MFA for remote access that could reach CDE 5.16 Identity management 5.17 Authentication information 6.7 Remote working 8.2 Privileged access rights 8.5 Secure authentication NIST-CSF-PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization NIST-CSF-PR.AA-02 Identities are proofed and bound to credentials based on the context of interactions NIST-CSF-PR.AA-03 Users, services, and hardware are authenticated NIST-CSF-PR.AA-04 Identity assertions are protected, conveyed, and verified NIST-CSF-PR.IR-01 Networks and environments are protected from unauthorized logical access and usage SOC2-CC5.1 CC5.1 Selecting control activities that mitigate risk (COSO principle 10) SOC2-CC6.1 CC6.1 Logical access security over protected information assets SOC2-CC6.2 CC6.2 Registering and authorising users before issuing credentials SOC2-CC6.3 CC6.3 Role-based access, least privilege and segregation of duties SOC2-P5.1 P5.1 Data subject access ASBv3-IM-5 Use single sign-on (SSO) for application access ASBv3-PA-5 Set up emergency access IM-1 Use centralized identity and authentication system IM-6 Use strong authentication controls E8-MFA-ML1 Multi-Factor Authentication - Maturity Level 1 E8-MFA-ML2 Multi-Factor Authentication - Maturity Level 2 E8-MFA-ML3 Multi-Factor Authentication - Maturity Level 3 6.3.2 Mobile devices and teleworking 6.6.2 User access management 6.6.4 System and application access control ANSSI-HYG-08 Identify Each Person by Name and Separate User and Administrator Roles ANSSI-HYG-13 Prefer Strong Authentication Where Possible 03.05.01 User Identification and Authentication 03.05.03 Multi-Factor Authentication CE-AC.2 Authenticate Users Before Granting Access CE-SC.4 Authenticate Users Before Access ASD37-20 Multi-factor authentication (Essential) AUCDR-IS-1 Limit risk of unauthorised access to the CDR data environment Art.21.2.j Multi-factor or continuous authentication, secured communications and secured emergency communications 161R1-IA-2 Identification and Authentication (Organizational Users) 3.5.3e Prohibit Connection of Unknown or Unverified System Components IA-2 IA-2 Identification and Authentication (Organizational Users) IA-2 IA-2 Identification and Authentication (Organizational Users) IA-2 IA-2 Identification and Authentication (Organizational Users) Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in IA - Identification and Authentication You are reading one control. How much of NIST SP 800-53 Rev 5 have you already done? NIST SP 800-53 Rev 5 NIST800-IA-2 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST SP 800-53 Rev 5 your existing evidence covers. Hold ISO 27001:2022 and 163 of 1014 NIST SP 800-53 Rev 5 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 342 were rejected on the ISO 27001:2022 pair alone.
Query this from an agent The graph holds this control, the 113 it maps to, and the evidence behind each claim, over MCP and REST.