--- title: "NIST 800-171 3.5 Identification and Authentication" description: "The 11 NIST SP 800-171 Identification and Authentication requirements (3.5, CMMC IA): text, SPRS points, POA&M rules and evidence." url: https://policycortex.com/nist-800-171/identification-and-authentication sealed: 2026-11-11 amended: 2026-11-11 register: nist-800-171/identification-and-authentication records: 4 digest: sha3:62bd041a8d5695668075db0d261217c88c698a8708edbd2769eb791fd83ba5b1 --- # NIST 800-171 3.5 Identification and Authentication NIST 800-171 / Identification and Authentication Identification and Authentication makes sure every user, process and device is known and proves who it is before getting in. It sets the rules for multifactor authentication, replay resistance, identifiers and passwords. 11 requirements · up to 27 SPRS points · 7 can go on a CMMC POA&M ## The 11 Identification and Authentication requirements | Requirement | CMMC practice | SPRS points | Requirement text | |---|---|---|---| | [3.5.1 Identification](https://policycortex.com/nist-800-171/identification-and-authentication/3.5.1) | IA.L2-3.5.1 | 5 points | Identify system users, processes acting on behalf of users, and devices. | | [3.5.2 Authentication](https://policycortex.com/nist-800-171/identification-and-authentication/3.5.2) | IA.L2-3.5.2 | 5 points | Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems. | | [3.5.3 Multifactor Authentication](https://policycortex.com/nist-800-171/identification-and-authentication/3.5.3) | IA.L2-3.5.3 | 3 or 5 points | Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts. | | [3.5.4 Replay Resistance](https://policycortex.com/nist-800-171/identification-and-authentication/3.5.4) | IA.L2-3.5.4 | 1 point | Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts. | | [3.5.5 Identifier Reuse](https://policycortex.com/nist-800-171/identification-and-authentication/3.5.5) | IA.L2-3.5.5 | 1 point | Prevent reuse of identifiers for a defined period. | | [3.5.6 Inactive Accounts](https://policycortex.com/nist-800-171/identification-and-authentication/3.5.6) | IA.L2-3.5.6 | 1 point | Disable identifiers after a defined period of inactivity. | | [3.5.7 Password Complexity](https://policycortex.com/nist-800-171/identification-and-authentication/3.5.7) | IA.L2-3.5.7 | 1 point | Enforce a minimum password complexity and change of characters when new passwords are created. | | [3.5.8 Password Reuse](https://policycortex.com/nist-800-171/identification-and-authentication/3.5.8) | IA.L2-3.5.8 | 1 point | Prohibit password reuse for a specified number of generations. | | [3.5.9 Temporary Passwords](https://policycortex.com/nist-800-171/identification-and-authentication/3.5.9) | IA.L2-3.5.9 | 1 point | Allow temporary password use for system logons with an immediate change to a permanent password. | | [3.5.10 Protected Passwords](https://policycortex.com/nist-800-171/identification-and-authentication/3.5.10) | IA.L2-3.5.10 | 5 points | Store and transmit only cryptographically-protected passwords. | | [3.5.11 Obscured Feedback](https://policycortex.com/nist-800-171/identification-and-authentication/3.5.11) | IA.L2-3.5.11 | 1 point | Obscure feedback of authentication information. | ## Identification and Authentication: points and the CMMC POA&M **Q: How many SPRS points can the Identification and Authentication family cost?** A: Up to 27 of the 313 points a score can lose: 4 worth 5 points and 7 worth 1. 3.5.3 can instead lose 3 with partial credit. **Q: Which Identification and Authentication requirements can go on a CMMC POA&M?** A: 7 of the 11: 3.5.4, 3.5.5, 3.5.6, 3.5.7, 3.5.8, 3.5.9 and 3.5.11, worth 1 point each. The others are worth more than 1 point, which 32 CFR 170.21(a)(2)(ii) does not admit. The score must also be at least 88. ## Related pages - **Calculator**: [SPRS score calculator: mark the Identification and Authentication requirements and see what they cost.](https://policycortex.com/sprs-score-calculator#family-IA) - **Sample package**: [Sample package: an SSP, a POA&M and an evidence chain the product generated from demonstration data.](https://policycortex.com/sample-package) - **Previous family**: [3.4 Configuration Management](https://policycortex.com/nist-800-171/configuration-management) - **Next family**: [3.6 Incident Response](https://policycortex.com/nist-800-171/incident-response) - **All requirements**: [All 110 NIST SP 800-171 requirements, by family.](https://policycortex.com/nist-800-171) Know the family. Keep the evidence for every requirement in it. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book) ## Register colophon | Seq | Label | SHA3-256 | Prev | |---|---|---|---| | REC 0000 | FAMILY | abf0919088c6 | d1cdfd620b84 | | REC 0001 | REQUIREMENTS | 0cd803ed27dd | abf0919088c6 | | REC 0002 | POINTS AND POA&M | a904c2f04acb | 0cd803ed27dd | | REC 0003 | RELATED | 62bd041a8d56 | a904c2f04acb | Head sha3:62bd041a8d5695668075db0d261217c88c698a8708edbd2769eb791fd83ba5b1. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.