CMMC Requirement IA.L2-3.5.1 – Identification: Identify information system users, processes acting on behalf of users, or devices.
Links to Publicly Available Resources
This document provides self-assessment guidance for conducting Cybersecurity Maturity Model Certification (CMMC) assessments for Level 1. This example procedure from the EPA describes how the agency is to implement security control requirements for the NIST SP 800-53 Identification and Authentication (IA) control family. This document describes security identifiers and how they work in regards to accounts and groups in the Windows operating system. This YouTube video discusses identification and authentication issues in the context of computer security. In this edition of the On Call Compliance Solutions Compliance Tip of the Week, we focus on individual authenticators including passwords, key cards, cryptographic devices, and one-time password devices. Let’s talk about NIST 800-171 Control 3.5.1 Identify system users, processes acting on behalf of users, and devices.
Common device identifiers include media access control (MAC), Internet Protocol (IP) addresses, or device-unique token identifiers. Management of individual identifiers is not applicable to shared system accounts. Typically, individual identifiers are the user names associated with the system accounts assigned to those individuals. Organizations may require unique identification of individuals in group accounts or for detailed accountability of individual activity. In addition, this requirement addresses individual identifiers that are not necessarily associated with system accounts. Organizational devices requiring identification may be defined by type, by device, or by a combination of type/device. NIST SP 800-63-3 provides guidance on digital identities.
Further Discussion
Make sure to assign individual, unique identifiers (e.g., user names) to all users and processes that access company systems. Authorized devices also should have unique identifiers. Unique identifiers can be as simple as a short set of alphanumeric characters (e.g., SW001 could refer to a network switch, SW002 could refer to a different network switch).
This requirement, IA.L2-3.5.1, provides a vetted and trusted identity that supports the access control mechanism required by AC.L2-3.1.1.