NIST 800-171 3.5 Identification and Authentication
Identification and Authentication makes sure every user, process and device is known and proves who it is before getting in. It sets the rules for multifactor authentication, replay resistance, identifiers and passwords.
11 requirementsup to 27 SPRS points7 can go on a CMMC POA&M
The 11 Identification and Authentication requirements
- 3.5.1 IdentificationIA.L2-3.5.1Identify system users, processes acting on behalf of users, and devices.
- 3.5.2 AuthenticationIA.L2-3.5.2Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.
- 3.5.3 Multifactor AuthenticationIA.L2-3.5.3Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.
- 3.5.4 Replay ResistanceIA.L2-3.5.4Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.
- 3.5.5 Identifier ReuseIA.L2-3.5.5Prevent reuse of identifiers for a defined period.
- 3.5.6 Inactive AccountsIA.L2-3.5.6Disable identifiers after a defined period of inactivity.
- 3.5.7 Password ComplexityIA.L2-3.5.7Enforce a minimum password complexity and change of characters when new passwords are created.
- 3.5.8 Password ReuseIA.L2-3.5.8Prohibit password reuse for a specified number of generations.
- 3.5.9 Temporary PasswordsIA.L2-3.5.9Allow temporary password use for system logons with an immediate change to a permanent password.
- 3.5.10 Protected PasswordsIA.L2-3.5.10Store and transmit only cryptographically-protected passwords.
- 3.5.11 Obscured FeedbackIA.L2-3.5.11Obscure feedback of authentication information.
Identification and Authentication: points and the CMMC POA&M
- Q-01
How many SPRS points can the Identification and Authentication family cost?
Up to 27 of the 313 points a score can lose: 4 worth 5 points and 7 worth 1. 3.5.3 can instead lose 3 with partial credit.
- Q-02
Which Identification and Authentication requirements can go on a CMMC POA&M?
7 of the 11: 3.5.4, 3.5.5, 3.5.6, 3.5.7, 3.5.8, 3.5.9 and 3.5.11, worth 1 point each. The others are worth more than 1 point, which 32 CFR 170.21(a)(2)(ii) does not admit. The score must also be at least 88.
Know the family. Keep the evidence for every requirement in it.
- Published
- Last updated
- Unchanged since publication