IA-2 Identification and Authentication (Organizational Users)

Family IA

Baselines moderate

Mapped KSIs 2

Control statement

Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.
        Requirement: For all control enhancements that specify multifactor authentication, the implementation must adhere to the Digital Identity Guidelines specified in NIST Special Publication 800-63B.
        Requirement: Multi-factor authentication must be phishing-resistant.
        Requirement: All uses of encrypted virtual private networks must meet all applicable Federal requirements and architecture, dataflow, and security and privacy controls must be documented, assessed, and authorized to operate.
        Guidance: \"Phishing-resistant\" authentication refers to authentication processes designed to detect and prevent disclosure of authentication secrets and outputs to a website or application masquerading as a legitimate system.

Parameter placeholders {{ insert: param, … }} reference FedRAMP-set values in the resolved profile. Full parameter map is preserved in the catalog database.

Covered by these Key Security Indicators

KSI	Title	Category
KSI-IAM-01	Phishing-Resistant MFA Enforce multi-factor authentication (MFA) using methods that are difficult to intercept or impersonate (phishing-resistant MFA) for all user authentication.	Identity and Access Management
KSI-IAM-05	Least Privilege _Persistently_ ensure that identity and access management employs measures to ensure each user or device can only access the resources they need.	Identity and Access Management