Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.
IA.L1-3.5.1 · FAR 52.204-21 (b)(1)(v) · NIST SP 800-171 3.5.1
Identification
Identify information system users, processes acting on behalf of users, or devices
Reviewed by a credentialed officer on June 12, 2026. The officer advises and never signs; this corroborates your own self assessment and certifies nothing. The finding, and the affirmation, stay yours.
Who is accountable for this safeguard
They get the reminder when this evidence goes stale. Carries into next year's cycle.
What it means
Every login is tied to a specific, identifiable user, no generic 'office@company.com' shared accounts.
Why it matters
Shared accounts make it impossible to say who did what, which voids the rest of your compliance story. One login per person is the floor; cleaning this up usually takes an afternoon.
The proof on file
- Authorized users roster (Microsoft 365)Pulled read only from Microsoft 365 · June 10, 2026On file
The narrative on file
Every user has a unique named account in Microsoft Entra ID. Shared or generic logins are not permitted. Devices are enrolled in Intune and identified by the company before they are allowed to connect.
You answer in plain English. Charlie drafts the narrative for your System Security Plan, and you confirm it.
What makes it pass
- Every account is tied to a named individual, no 'office', 'reception', 'admin' shared accounts
- If shared mailboxes exist they are configured as shared mailboxes (not user accounts), visible in the screenshot
- Service / integration accounts named with a documented owner
- Date of capture visible (system clock or filename)
Assessment objectives, NIST SP 800-171A
The team at Cedar Ridge Machine Works, LLC confirmed this safeguard MET. The evidence above is a living document: refresh rosters, devices, and accounts whenever the business changes and the safeguard stays current. The single signature happens in Attest & file, once all 17 are met.
Next safeguard →Need the exact clicks?Microsoft 365, step by step
- 1Go to admin.microsoft.com → Users → Active users
- 2Confirm every account has an individual display name and UPN (no 'office', 'reception', 'shared')
- 3If shared mailboxes exist, confirm they are configured as shared mailboxes, not user accounts
- 4Screenshot the user list
Capture: Screenshot of the user list showing individual accounts only.
This is one of 17
Answer in plain English, file the proof, confirm it MET.
The team at Cedar Ridge Machine Works, LLC walked all 17 the same way. The platform explains each one in plain English and tells you what proof to grab or pulls it from Microsoft 365, Charlie drafts the paperwork with you, a credentialed officer reviews it, and your team confirms each one MET. The self assessment stays your act. Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.