NIST 800-53 r5 · Controls catalogue · Family IA
IA-13Identity Providers and Authorization Servers
Employ identity providers and authorization servers to manage user, device, and non-person entity (NPE) identities, attributes, and access rights supporting authentication and authorization decisions in accordance with {{ insert: param, ia-13_odp.01 }} using {{ insert: param, ia-13_odp.02 }}.
Last updated: 22 August 2026 07:11 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: partial · 2 mapping(s) from 1 framework(s): OWASP-Web 2 (partial)
Implementations targeting this control (0)
- No implementations targeting this control yet.
ATT&CK techniques this control mitigates (17)
- T1078 Valid Accounts Stealth, Persistence, Privilege Escalation, Initial Access
- T1078.002 Domain Accounts Stealth, Persistence, Privilege Escalation, Initial Access
- T1078.004 Cloud Accounts Stealth, Persistence, Privilege Escalation, Initial Access
- T1111 Multi-Factor Authentication Interception Credential Access
- T1134 Access Token Manipulation Stealth, Privilege Escalation
- T1134.001 Token Impersonation/Theft Stealth, Privilege Escalation
- T1134.003 Make and Impersonate Token Stealth, Privilege Escalation
- T1134.005 SID-History Injection Stealth, Privilege Escalation
- T1528 Steal Application Access Token Credential Access
- T1556 Modify Authentication Process Defense Impairment, Persistence, Credential Access
- T1556.006 Multi-Factor Authentication Defense Impairment, Persistence, Credential Access
- T1556.007 Hybrid Identity Defense Impairment, Persistence, Credential Access
- T1556.009 Conditional Access Policies Defense Impairment, Persistence, Credential Access
- T1606 Forge Web Credentials Credential Access
- T1606.002 SAML Tokens Credential Access
- T1621 Multi-Factor Authentication Request Generation Credential Access
- T1649 Steal or Forge Authentication Certificates Credential Access
Weaknesses this control addresses (8)AI-assisted
CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.
| CWE | Name | CVEs | Why this control addresses it |
|---|---|---|---|
CWE-862 | Missing Authorization | 10,200+ | Requiring authorization servers ensures authorization is performed for protected functions. |
CWE-284 | Improper Access Control | 6,900+ | Authorization servers centrally manage access rights, preventing improper access control. |
CWE-287 | Improper Authentication | 5,200+ | Identity providers centralize and enforce authentication mechanisms, reducing improper authentication. |
CWE-863 | Incorrect Authorization | 3,900+ | Centralized authorization servers reduce incorrect authorization by enforcing consistent policies. |
CWE-306 | Missing Authentication for Critical Function | 3,300+ | Identity providers mandate authentication for functions that would otherwise lack it. |
CWE-798 | Use of Hard-coded Credentials | 2,000+ | External identity providers eliminate the need for hard-coded credentials in applications. |
CWE-285 | Improper Authorization | 1,500+ | Dedicated authorization servers support policy-based decisions, mitigating improper authorization. |
CWE-288 | Authentication Bypass Using an Alternate Path or Channel | 600+ | Centralized IdPs close alternate authentication paths that enable bypass. |
Top CVEs where this control is the strongest mitigation
| CVE | Risk | CVSS | EPSS | Match |
|---|---|---|---|---|
| No CVEs annotated to this control yet — the per-CVE backfill is in progress. | ||||