IA-2 handles your staff. IA-8 handles everyone else: customers, partners, citizens and other outside parties who use your system. The statement is to uniquely identify and authenticate non organizational users, or processes acting on their behalf.
800-53 binds US federal systems and contract holders. For other companies it works as a reference for customer login design. Product security reviews often ask the same thing.
What it means in practice
NIST defines non organizational users as system users other than those covered by IA-2. They must be identified and authenticated for all accesses except those documented under AC-14. The guidance notes that federal systems may need this to protect federal, proprietary or privacy related information.
For a SaaS company this means customer accounts and partner portals. Each external user has a unique identity. Authentication strength should match the risk, so a user who can change billing or export data deserves more than one who views a dashboard.
Evidence to collect
- Product documentation of customer authentication options, including MFA and SSO.
- Configuration showing no shared customer logins and no anonymous access to protected functions.
- The documented list of any anonymous access allowed, with the reason.
- API authentication design: keys or tokens issued per customer and per integration.
- Logs that show external user identity on each action.
Common gaps
Support staff sharing a customer impersonation account. Partner portals with one login per company. Public endpoints that return private data without checks.
Enhancements worth knowing: IA-8.2 Acceptance of External Authenticators and IA-8.4 Use of Defined Profiles apply broadly. IA-8.1, IA-8.3 and IA-8.5 are tied to federal credential programs. IA-8.6 is Disassociability.
How to implement it
Offer MFA to all external users and require it for sensitive roles. Support federation with customer identity providers. Issue API credentials per integration with scopes. Log impersonation by support staff with a reason.
Quick check
Who falls under IA-8 instead of IA-2?
Users who are not employees or equivalent, such as customers, partners and other outside parties.
