CMMC Navigatorby Foxx Cyber Bedrock CMMC

↑↓ to move, Enter to open, Esc to close. Try 3.5.3, AC.L2-3.1.1, MFA or unmarked.

Identification and Authentication

Identify users, processes, and devices before authorizing access.

Identification and authentication is the family that contains multi-factor authentication. It covers unique identities for users and devices, how authenticators are issued and protected, password rules, and replay resistance. Two of its requirements are Level 1 practices.

  1. 3.5.1 Give every user, process, and device an identity IA Level 1 5 pt
  2. 3.5.2 Prove those identities IA Level 1 5 pt
  3. 3.5.3 Require multi-factor authentication IA Level 2 3 or 5 pt
  4. 3.5.4 Use replay-resistant authentication IA Level 2 1 pt
  5. 3.5.5 Do not recycle identifiers IA Level 2 1 pt
  6. 3.5.6 Disable dormant accounts IA Level 2 1 pt
  7. 3.5.7 Set password rules IA Level 2 1 pt
  8. 3.5.8 Block password reuse IA Level 2 1 pt
  9. 3.5.9 Force a change after a temporary password IA Level 2 1 pt
  10. 3.5.10 Never store or send passwords in the clear IA Level 2 5 pt
  11. 3.5.11 Hide password entry IA Level 2 1 pt