NIST 800-53 REV 5 • IDENTIFICATION AND AUTHENTICATION
IA-9 — Service Identification and Authentication
Uniquely identify and authenticate {{ insert: param, ia-09_odp }} before establishing communications with devices, users, or other services or applications.
Supplemental Guidance
Services that may require identification and authentication include web applications using digital certificates or services or applications that query a database. Identification and authentication methods for system services and applications include information or code signing, provenance graphs, and electronic signatures that indicate the sources of services. Decisions regarding the validity of identification and authentication claims can be made by services separate from the services acting on those decisions. This can occur in distributed system architectures. In such situations, the identification and authentication decisions (instead of actual identifiers and authentication data) are provided to the services that need to act on those decisions.
Practitioner Notes
This control requires services (not just people and devices) to identify and authenticate themselves — when one system talks to another, they must verify each other's identity.
Example 1: Use mutual TLS (mTLS) between microservices so that each service presents a certificate and verifies the other service's identity before exchanging data.
Example 2: Implement OAuth 2.0 client credentials flow for service-to-service authentication, where each service has unique client ID and secret stored in Azure Key Vault.