NIST SP 800-53 IA-8(2) Acceptance of External Authenticators

Requirements NIST SOURCE

Discussion (NIST Supplemental Guidance)

Acceptance of only NIST-compliant external authenticators applies to organizational systems that are accessible to the public (e.g., public-facing websites). External authenticators are issued by nonfederal government entities and are compliant with SP 800-63B . Approved external authenticators meet or exceed the minimum Federal Government-wide technical, security, privacy, and organizational maturity requirements. Meeting or exceeding Federal requirements allows Federal Government relying parties to trust external authenticators in connection with an authentication transaction at a specified authenticator assurance level.

Implementation Guidance

Engineering Interpretation

Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.

No engineering interpretation has been authored for IA-8(2) yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.

Assessment

NIST SP 800-53A REV 5.2.0

Assessment Objectives

only external authenticators that are NIST-compliant are accepted;
a list of accepted external authenticators is documented;
a list of accepted external authenticators is maintained.

Examine

[SELECT FROM: Identification and authentication policy; system security plan; procedures addressing user identification and authentication; system design documentation; system configuration settings and associated documentation; system audit records; list of third-party credentialing products, components, or services procured and implemented by organization; third-party credential verification records; evidence of third-party credentials; third-party credential authorizations; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with system operations responsibilities; organizational personnel with information security responsibilities; system/network administrators; system developers; organizational personnel with account management responsibilities].

Test

[SELECT FROM: Mechanisms supporting and/or implementing identification and authentication capabilities; mechanisms that accept external credentials].

Overlays

Showing the OT/ICS overlay for the parent control IA-8 — see the IA-8(2) entries within each baseline below.

OT/ICS Overlay SP 800-82r3

NIST SP 800-82r3 Appendix F, Table 22. Blank baseline means the control/control enhancement is not selected in that initial OT baseline.

LOW

Base control: Included (matches standard baseline)
Included: (1) (2) (4)

MODERATE

Base control: Included (matches standard baseline)
Included: (1) (2) (4)

HIGH

Base control: Included (matches standard baseline)
Included: (1) (2) (4)

STIGs & CCIs

No STIG checks or CCI mappings are currently loaded for IA-8(2). This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.

Learn more about STIG/CCI integration →

Evidence

Potential Evidence — Derived

Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.

Policy

Identification and authentication policy
system security plan

Configuration

system design documentation
system configuration settings and associated documentation

Testing

Mechanisms supporting and/or implementing identification and authentication capabilities
mechanisms that accept external credentials

Other Records

procedures addressing user identification and authentication
system audit records
list of third-party credentialing products, components, or services procured and implemented by organization
third-party credential verification records
evidence of third-party credentials
third-party credential authorizations
other relevant documents or records