Single Sign-on

LOW MODERATE HIGH

1 Overlay 0 Related Controls

Requirements NIST SOURCE

Provide a single sign-on capability for [system accounts and services].

Discussion (NIST Supplemental Guidance)

Single sign-on enables users to log in once and gain access to multiple system resources. Organizations consider the operational efficiencies provided by single sign-on capabilities with the risk introduced by allowing access to multiple systems via a single authentication event. Single sign-on can present opportunities to improve system security, for example by providing the ability to add multi-factor authentication for applications and systems (existing and new) that may not be able to natively support multi-factor authentication.

Implementation Guidance

Engineering Interpretation

Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.

No engineering interpretation has been authored for IA-2(10) yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.

Assessment

NIST SP 800-53A REV 5.2.0

Assessment Objectives

system accounts and services for which a single sign-on capability must be provided are defined;
a single sign-on capability is provided for <IA-02(10)_ODP system accounts and services>.

Examine

[SELECT FROM: Identification and authentication policy; system security plan; procedures addressing single sign-on capability for system accounts and services; procedures addressing identification and authentication; system design documentation; system configuration settings and associated documentation; system audit records; list of system accounts and services requiring single sign-on capability; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with system operations responsibilities; organizational personnel with account management responsibilities; organizational personnel with information security responsibilities; system/network administrators; system developers].

Test

[SELECT FROM: Mechanisms supporting and/or implementing identification and authentication capabilities; mechanisms supporting and/or implementing single sign-on capability for system accounts and services].

Overlays

Showing the OT/ICS overlay for the parent control IA-2 — see the IA-2(10) entries within each baseline below.

OT/ICS Overlay SP 800-82r3

NIST SP 800-82r3 Appendix F, Table 22. Blank baseline means the control/control enhancement is not selected in that initial OT baseline.

LOW

Base control: Included (matches standard baseline)
Included: (1) (2) (8) (12)

MODERATE

Base control: Included (matches standard baseline)
Included: (1) (2) (8) (12)

HIGH

Base control: Included (matches standard baseline)
Included: (1) (2) (5) (8) (12)

STIGs & CCIs

No STIG checks or CCI mappings are currently loaded for IA-2(10). This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.

Learn more about STIG/CCI integration →

Evidence

Potential Evidence — Derived

Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.

Policy

Identification and authentication policy
system security plan

Configuration

system design documentation
system configuration settings and associated documentation

Testing

Mechanisms supporting and/or implementing identification and authentication capabilities
mechanisms supporting and/or implementing single sign-on capability for system accounts and services

Other Records

procedures addressing single sign-on capability for system accounts and services
procedures addressing identification and authentication
system audit records
list of system accounts and services requiring single sign-on capability
other relevant documents or records