Identification and Authentication (IA)

CMMC Identification and Authentication (IA) Requirements

Identification and Authentication contains 11 CMMC Level 2 requirements focused on verifying who is accessing your systems. These controls ensure that users are who they claim to be before granting access to Controlled Unclassified Information.

Identification means claiming an identity (like entering a username). Authentication means proving that identity (like entering a password or using a fingerprint).

Without proper identification and authentication, anyone could access your systems by simply claiming to be an authorized user.

Why Identification and Authentication Matter for CMMC

The Department of Defense requires strong Identification and Authentication because CUI must only be accessible to verified, authorized users.

CUI stands for Controlled Unclassified Information—sensitive government data requiring protection but not classified as secret.

Identity verification is fundamental to security:

• Access Control depends on knowing who is requesting access
• Audit logs only have value if you know who performed actions
• Accountability requires a reliable identity
• Remote access security depends on verifying remote users

Weak authentication is one of the most common attack vectors. Stolen or guessed passwords enable most breaches.

The 11 Identification and Authentication Requirements

IA.L2-3.5.1: User Identification

“Identify system users, processes acting on behalf of users, and devices.”

Before authenticating anyone or anything, you must identify them:

• Users need unique identifiers (usernames)
• Automated processes need identifiable service accounts
• Devices connecting to networks need identification

No anonymous access to systems handling CUI.

IA.L2-3.5.2: User Authentication

“Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.”

After identification, verify the claimed identity:

• Users prove identity through passwords, tokens, and biometrics
• Processes authenticate through credentials or certificates
• Devices authenticate through certificates or pre-shared keys

Authentication must occur before granting any access.

IA.L2-3.5.3: Multi-Factor Authentication

“Use multi-factor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.”

This is one of the most important CMMC requirements. Multi-factor authentication (MFA) requires two or more factors to verify identity:

• Something you know: Password, PIN
• Something you have: Phone, security key, smart card
• Something you are: Fingerprint, face recognition

Multi-factor authentication (MFA) requires presenting two or more different types of credentials to verify identity, making stolen passwords alone insufficient for access.

CMMC requires MFA for:

• All privileged (administrator) accounts, both local and network access
• All non-privileged accounts accessing systems over a network

In practice, this means everyone accessing CUI systems needs MFA, not just administrators.

IA.L2-3.5.4: Replay-Resistant Authentication

“Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.”

Prevent attackers from capturing and reusing authentication data:

• Use authentication protocols resistant to replay attacks
• Implement session tokens that expire
• Use cryptographic authentication methods

Modern MFA solutions inherently provide replay resistance through one-time codes and challenge-response mechanisms.

IA.L2-3.5.5: Identifier Reuse Prevention

“Prevent reuse of identifiers for a defined period.”

When users leave or accounts are disabled, do not immediately reassign their usernames to new users:

• Maintain a waiting period before reusing identifiers
• Ensure audit trails remain attributable to the correct individuals
• Prevent confusion about who performed past actions

IA.L2-3.5.6: Identifier Disabling

“Disable identifiers after a defined period of inactivity.”

Accounts that are not being used should be disabled:

• Set inactivity timeout (commonly 90 days)
• Automatically disable accounts exceeding the threshold
• Review disabled accounts before re-enabling

Inactive accounts are targets for attackers because unusual activity may go unnoticed.

IA.L2-3.5.7: Password Complexity

“Enforce a minimum password complexity and change of characters when new passwords are created.”

Passwords must meet minimum complexity requirements:

• Minimum length (typically 12+ characters recommended)
• Mix of character types (uppercase, lowercase, numbers, special characters)
• Different from previous passwords
• Not easily guessable (no dictionary words, names, dates)

IA.L2-3.5.8: Password Reuse Prohibition

“Prohibit password reuse for a specified number of generations.”

Users cannot cycle back to old passwords:

• Remember previous passwords (typically 24 generations)
• Prevent reusing any remembered password
• Force truly new passwords each time

IA.L2-3.5.9: Temporary Passwords

“Allow temporary password use for system logons with an immediate change to a permanent password.”

When issuing temporary or initial passwords:

• Require change at first login
• Set short expiration on temporary passwords
• Use secure methods to deliver temporary passwords

Temporary passwords should not remain valid after first use.

IA.L2-3.5.10: Cryptographic Protection of Passwords

“Store and transmit only cryptographically protected passwords.”

Passwords must be encrypted:

• Store passwords using strong one-way hashing (not plain text)
• Transmit passwords over encrypted connections only
• Never store or send passwords in clear text

Cryptographic protection means using mathematical algorithms to scramble passwords so they cannot be read even if stolen.

IA.L2-3.5.11: Obscure Authentication Feedback

“Obscure feedback of authentication information.”

Hide authentication data during entry:

• Display dots or asterisks when typing passwords
• Do not echo passwords on screen
• Mask authentication information in logs

Prevent shoulder surfing and inadvertent password exposure.

Implementing Identification and Authentication

Deploy Multi-Factor Authentication

MFA is the highest-priority IA control. Implement MFA for all users accessing CUI systems:

• Microsoft 365: Enable Azure MFA or Microsoft Authenticator
• VPN: Configure MFA for remote access
• On-premises systems: Implement MFA solutions like Duo, RSA, or similar
• Privileged accounts: Require MFA for all administrator access

Configure Password Policies

Establish password requirements in your directory services:

• Minimum 12 characters (NIST recommends longer passwords over complexity)
• Complexity requirements enabled
• Password history of 24 passwords
• Account lockout after failed attempts

Manage User Accounts

Implement proper account lifecycle management:

• Create accounts only when needed with unique identifiers
• Disable accounts when employees leave
• Review accounts regularly for inactive users
• Require password change on first login for new accounts

Secure Password Storage

Ensure systems store passwords securely:

• Verify systems use strong hashing algorithms
• Do not store passwords in spreadsheets or documents
• Use password managers for service account credentials
• Encrypt credential storage

Common Identification and Authentication Mistakes

Mistake 1: Skipping MFA

MFA is required, not optional. Implement it for all network access to CUI systems, not just remote access or administrators.

Mistake 2: Shared Accounts

Shared accounts violate identification requirements. Every user needs their own unique account.

Mistake 3: Weak Passwords

Short or simple passwords are easily compromised. Enforce strong password policies.

Mistake 4: No Account Monitoring

Failing to disable inactive accounts creates security risks. Implement automatic disabling and regular reviews.

Mistake 5: Storing Plain Text Passwords

Passwords in spreadsheets, documents, or unencrypted storage violate cryptographic protection requirements.

Key Takeaways

Identification and Authentication’s 11 requirements ensure users prove who they are before accessing CUI. The most critical requirement is multi-factor authentication—implement MFA for all users accessing CUI systems.

Establish strong password policies, manage user accounts throughout their lifecycle, disable inactive accounts, and ensure passwords are always encrypted in storage and transmission. These controls prevent unauthorized access by verifying every user’s identity.

---

Related Articles:

• What is CMMC Level 2?
• CMMC Access Control Requirements for Level 2
• NIST SP 800-171 Rev 2 – Identification and Authentication Family
• NIST SP 800-63B Digital Identity Guidelines
• 32 CFR Part 170 – CMMC Program Rule

Official Sources: This article is based on NIST SP 800-171 Revision 2 “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations,” specifically the Identification and Authentication family (Section 3.5), and the DoD CMMC Level 2 Assessment Guide.

---

Need help implementing authentication controls for CMMC compliance? Contact Greypike for expert guidance on Level 1 and Level 2 certification, or get started with Obolix to streamline your compliance journey.