CMMC Navigatorby Foxx Cyber Bedrock CMMC

↑↓ to move, Enter to open, Esc to close. Try 3.5.3, AC.L2-3.1.1, MFA or unmarked.

03.05.12Authenticator Management in Rev. 3

New in Revision 3 — no Revision 2 equivalent. Nothing in NIST SP 800-171 Rev. 2 maps onto this number, so it has no Rev. 2 page and no side-by-side; the Rev. 3 text is below in full. It carries organization-defined parameters.

Status as of 2026-09-08

Rev. 2 is what a contract requires today. DFARS 252.204-7012 and the CMMC rule at 32 CFR 170 point at NIST SP 800-171 Rev. 2, and a standing DoD class deviation keeps it there. NIST has published Rev. 3, but publishing a revision does not change an obligation. A move to Rev. 3 would arrive through the Department's reform process and formal rulemaking, a change to that deviation or an amendment to the rule, not through publication. The Department has published its organization-defined parameter values for Rev. 3 in preparation; that is groundwork, not adoption.

The requirement

Rev. 3 · not adopted 03.05.12 Authenticator Management

a. Verify the identity of the individual, group, role, service, or device receiving the authenticator as part of the initial authenticator distribution.

b. Establish initial authenticator content for any authenticators issued by the organization.

c. Establish and implement administrative procedures for initial authenticator distribution; for lost, compromised, or damaged authenticators; and for revoking authenticators.

d. Change default authenticators at first use.

e. Change or refresh authenticators [Assignment: organization-defined frequency] or when the following events occur: [Assignment: organization-defined events].

f. Protect authenticator content from unauthorized disclosure and modification.

NIST SP 800-171 Rev. 3, verbatim, with organization-defined blanks highlighted. Rev. 2 has no counterpart to place beside it.

Determination statements

What an assessor would check under NIST SP 800-171A Rev. 3. 12 statements, each one answered yes or no.

  1. 03.05.12.a the identity of the individual, group, role, service, or device receiving the authenticator as part of the initial authenticator distribution is verified.
  2. 03.05.12.b initial authenticator content for any authenticators issued by the organization is established.
  3. 03.05.12.c[01] administrative procedures for initial authenticator distribution are established.
  4. 03.05.12.c[02] administrative procedures for lost, compromised, or damaged authenticators are established.
  5. 03.05.12.c[03] administrative procedures for revoking authenticators are established.
  6. 03.05.12.c[04] administrative procedures for initial authenticator distribution are implemented.
  7. 03.05.12.c[05] administrative procedures for lost, compromised, or damaged authenticators are implemented.
  8. 03.05.12.c[06] administrative procedures for revoking authenticators are implemented.
  9. 03.05.12.d default authenticators are changed at first use.
  10. 03.05.12.e authenticators are changed or refreshed <A.03.05.12.ODP[01]: frequency> or when the following events occur: <A.03.05.12.ODP[02]: events>.
  11. 03.05.12.f[01] authenticator content is protected from unauthorized disclosure.
  12. 03.05.12.f[02] authenticator content is protected from unauthorized modification.

NIST SP 800-171A Rev. 3, verbatim.

Organization-defined parameters

Blanks the organization fills in. Defining each value is itself a determination in 800-171A Rev. 3.

  • A.03.05.12.ODP[01] the frequency for changing or refreshing authenticators is defined.
  • A.03.05.12.ODP[02] events that trigger the change or refreshment of authenticators are defined.

What NIST says

  • New security requirement based on IA-05(06) (SP 800-53, Revision 5).
  • Added new ODP: frequency to change or refresh authenticators
  • Added new ODP: events to require a change or refresh of authenticators

NIST, SP 800-171 Rev. 2 to Rev. 3 change analysis, class “New requirement”. At adoption, Bedrock files this under “New”.

NIST's Rev. 3 discussion for 03.05.12

Authenticators include passwords, cryptographic devices, biometrics, certificates, one-time password devices, and ID badges. The initial authenticator content is the actual content of the authenticator (e.g., the initial password). In contrast, requirements for authenticator content contain specific characteristics. Authenticator management is supported by organization-defined settings and restrictions for various authenticator characteristics (e.g., password complexity and composition rules, validation time window for time synchronous one-time tokens, and the number of allowed rejections during the verification stage of biometric authentication). The requirement to protect individual authenticators may be implemented by 03.15.03 for authenticators in the possession of individuals and by 03.01.01, 03.01.02, 03.01.05, and 03.13.08 for authenticators stored in organizational systems. This includes passwords stored in hashed or encrypted formats or files that contain hashed or encrypted passwords that are accessible with administrator privileges. Actions can be taken to protect authenticators, including maintaining possession of authenticators, not sharing authenticators with others, and immediately reporting lost, stolen, or compromised authenticators. Developers may deliver system components with factory default authentication credentials to allow for initial installation and configuration. Default authentication credentials are often well-known, easily discoverable, and present a significant risk. Authenticator management includes issuing and revoking authenticators for temporary access when they are no longer needed. The use of long passwords or passphrases may obviate the need to periodically change authenticators.

Identification and Authentication in Rev. 3

The active IA requirements in Rev. 3. Those with a Rev. 2 predecessor link to that comparison; those marked new have their own page.

All Identification and Authentication requirements in Rev. 2

What this means for you now

Nothing. Until a class deviation or a published rule adopts Rev. 3, no assessor asks about 03.05.12 and SPRS has no score for it. If you already do what it describes, note where the evidence lives and what value you use for the parameters above; that costs nothing and answers the question later.

Bedrock CMMC carries the Rev. 3 catalog beside your Rev. 2 package, so the day adoption lands the new requirements are a to-do list, not a surprise.

Where this page's facts come from
Rev. 3 03.05.12 text, determination statements, parameters, class and note
bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/rev3.json#requirements[]