Identification & Authentication
Identification and Authentication is proving that a user or device is who it claims to be before it touches CUI. Multi-factor authentication and strong credential practices are the heart of this family.
The 11 Identification & Authentication requirements
25 assessment objectives across this family.
- 3.5.1IdentificationIdentify system users, processes acting on behalf of users, and devices.5 pt✕ POA&M
- 3.5.2AuthenticationAuthenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.5 pt✕ POA&M
- 3.5.3Multifactor AuthenticationUse multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.5 pt✕ POA&M
- 3.5.4Replay-resistant AuthenticationEmploy replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.1 pt
- 3.5.5Identifier ReusePrevent reuse of identifiers for a defined period.1 pt
- 3.5.6Identifier HandlingDisable identifiers after a defined period of inactivity.1 pt
- 3.5.7Password ComplexityEnforce a minimum password complexity and change of characters when new passwords are created.1 pt
- 3.5.8Password ReuseProhibit password reuse for a specified number of generations.1 pt
- 3.5.9Temporary PasswordsAllow temporary password use for system logons with an immediate change to a permanent password.1 pt
- 3.5.10Cryptographically-protected PasswordsStore and transmit only cryptographically-protected passwords.5 pt✕ POA&M
- 3.5.11Obscure FeedbackObscure feedback of authentication information.1 pt
Build Identification & Authentication, and all 14 families, with an officer
The Level 2 workspace walks your team through all 110 requirements at the objective level, drafts your SSP section by section from your own record for your team to read and accept, gives a prime or your own internal auditor a read only seat on the same record, and a credentialed officer reviews every step.
Book a free advisory callNo credit card, and Level 1 and Level 2 are both open, so sign up for the level your contracts call for. Self assessed and self attested: you score yourself in SPRS on a three year cycle and your senior official affirms it every year. As of September 3, 2026 a class deviation directs contracting officers to remove third party assessment from contracts. The program rule still provides for it, so your solicitation sets the track. Your team builds the same evidence either way. DFARS 252.204-7012 is unaffected, and the NIST SP 800-171 Rev 2 baseline is unchanged.
Questions, answered
How many CMMC Level 2 requirements are in Identification & Authentication?+
The Identification & Authentication family (IA) has 11 of the 110 CMMC Level 2 requirements, assessed against 25 objectives from NIST SP 800-171A.
What is the Identification & Authentication family about?+
Identification and Authentication is proving that a user or device is who it claims to be before it touches CUI. Multi-factor authentication and strong credential practices are the heart of this family.