CMMC Practice IA.L1-3.5.1 – Identification: Identify information system users, processes acting on behalf of users, or devices.
Links to Publicly Available Resources
This document provides assessment guidance for Level 1 of the Cybersecurity Maturity Model Certification (CMMC). This example procedure from the EPA describes how the agency is to implement security control requirements for the NIST SP 800-53 Identification and Authentication (IA) control family. This article provides a comprehensive description of Data Loss Prevention (DLP). The article includes best Practices for DLP planning and preparation, and tools for automating DLP. This document describes security identifiers and how they work in regards to accounts and groups in the Windows operating system. This example policy describes the configuration of resources to uniquely identify and authenticate users not affiliated with the university who are permitted to utilize university information resources. This example policy describes the capability for information resources to uniquely identify and authenticate university faculty, staff, students, and other approved users. This example policy describes how user or device identifiers are managed by receiving appropriate authorization to initially assign a user, selecting a unique identifier, preventing the reuse of identifiers, and disabling the user identifier after a period of inactivity or change in job status. This YouTube video discusses identification and authentication issues in the context of computer security. In this edition of the On Call Compliance Solutions Compliance Tip of the Week, we focus on individual authenticators including passwords, key cards, cryptographic devices, and one-time password devices. Let’s talk about NIST 800-171 Control 3.5.1 Identify system users, processes acting on behalf of users, and devices.
Discussion [NIST SP 800-171 R2]
Common device identifiers include media access control (MAC), Internet Protocol (IP) addresses, or device-unique token identifiers. Management of individual identifiers is not applicable to shared system accounts. Typically, individual identifiers are the user names associated with the system accounts assigned to those individuals. Organizations may require unique identification of individuals in group accounts or for detailed accountability of individual activity. In addition, this requirement addresses individual identifiers that are not necessarily associated with system accounts. Organizational devices requiring identification may be defined by type, by device, or by a combination of type/device. NIST SP 800-63-3 provides guidance on digital identities.
Further Discussion
Make sure to assign individual, unique identifiers (e.g., user names) to all users and processes that access company systems. Authorized devices also should have unique identifiers. Unique identifiers can be as simple as a short set of alphanumeric characters (e.g., SW001 could refer to a network switch, SW002 could refer to a different network switch).
This practice, IA.L1-3.5.1, provides a vetted and trusted identity that supports the access control mechanism required by AC.L1-3.1.1.