CMMC Navigatorby Foxx Cyber Bedrock CMMC

↑↓ to move, Enter to open, Esc to close. Try 3.5.3, AC.L2-3.1.1, MFA or unmarked.

3.1.1Know who and what is allowed on your systems in Rev. 3

Reworded: 03.01.01 Account Management. Gains organization-defined parameters.

Status as of 2026-09-08

Rev. 2 is what a contract requires today. DFARS 252.204-7012 and the CMMC rule at 32 CFR 170 point at NIST SP 800-171 Rev. 2, and a standing DoD class deviation keeps it there. NIST has published Rev. 3, but publishing a revision does not change an obligation. A move to Rev. 3 would arrive through the Department's reform process and formal rulemaking, a change to that deviation or an amendment to the rule, not through publication. The Department has published its organization-defined parameter values for Rev. 3 in preparation; that is groundwork, not adoption.

Side by side

Rev. 2 · in force 3.1.1 Authorized Access Control

Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).

Assessment objectives · 800-171A

  1. [a] authorized users are identified
  2. [b] processes acting on behalf of authorized users are identified
  3. [c] devices (and other systems) authorized to connect to the system are identified
  4. [d] system access is limited to authorized users
  5. [e] system access is limited to processes acting on behalf of authorized users
  6. [f] system access is limited to authorized devices (including other systems)

Rev. 3 · not adopted 03.01.01 Account Management

a. Define the types of system accounts allowed and prohibited.

b. Create, enable, modify, disable, and remove system accounts in accordance with policy, procedures, prerequisites, and criteria.

c. Specify:

01. Authorized users of the system,

02. Group and role membership, and

03. Access authorizations (i.e., privileges) for each account.

d. Authorize access to the system based on:

01. A valid access authorization and

02. Intended system usage.

e. Monitor the use of system accounts.

f. Disable system accounts when:

01. The accounts have expired,

02. The accounts have been inactive for [Assignment: organization-defined time period],

03. The accounts are no longer associated with a user or individual,

04. The accounts are in violation of organizational policy, or

05. Significant risks associated with individuals are discovered.

g. Notify account managers and designated personnel or roles within:

01. [Assignment: organization-defined time period] when accounts are no longer required.

02. [Assignment: organization-defined time period] when users are terminated or transferred.

03. [Assignment: organization-defined time period] when system usage or the need-to-know changes for an individual.

h. Require that users log out of the system after [Assignment: organization-defined time period] of expected inactivity or when [Assignment: organization-defined circumstances].

Determination statements · 800-171A Rev. 3

  1. 03.01.01.a[01] system account types allowed are defined.
  2. 03.01.01.a[02] system account types prohibited are defined.
  3. 03.01.01.b[01] system accounts are created in accordance with organizational policy, procedures, prerequisites, and criteria.
  4. 03.01.01.b[02] system accounts are enabled in accordance with organizational policy, procedures, prerequisites, and criteria.
  5. 03.01.01.b[03] system accounts are modified in accordance with organizational policy, procedures, prerequisites, and criteria.
  6. 03.01.01.b[04] system accounts are disabled in accordance with organizational policy, procedures, prerequisites, and criteria.
  7. 03.01.01.b[05] system accounts are removed in accordance with organizational policy, procedures, prerequisites, and criteria.
  8. 03.01.01.c.01 authorized users of the system are specified.
  9. 03.01.01.c.02 group and role memberships are specified.
  10. 03.01.01.c.03 access authorizations (i.e., privileges) for each account are specified.
  11. 03.01.01.d.01 access to the system is authorized based on a valid access authorization.
  12. 03.01.01.d.02 access to the system is authorized based on intended system usage.
  13. 03.01.01.e the use of system accounts is monitored.
  14. 03.01.01.f.01 system accounts are disabled when the accounts have expired.
  15. 03.01.01.f.02 system accounts are disabled when the accounts have been inactive for <A.03.01.01.ODP[01]: time period>.
  16. 03.01.01.f.03 system accounts are disabled when the accounts are no longer associated with a user or individual.
  17. 03.01.01.f.04 system accounts are disabled when the accounts violate organizational policy.
  18. 03.01.01.f.05 system accounts are disabled when significant risks associated with individuals are discovered.
  19. 03.01.01.g.01 account managers and designated personnel or roles are notified within <A.03.01.01.ODP[02]: time period> when accounts are no longer required.
  20. 03.01.01.g.02 account managers and designated personnel or roles are notified within <A.03.01.01.ODP[03]: time period> when users are terminated or transferred.
  21. 03.01.01.g.03 account managers and designated personnel or roles are notified within <A.03.01.01.ODP[04]: time period> when system usage or the need-to-know changes for an individual.
  22. 03.01.01.h users are required to log out of the system after <A.03.01.01.ODP[05]: time period> of expected inactivity or when the following circumstances occur: <A.03.01.01.ODP[06]: circumstances>.

Organization-defined parameters

  • A.03.01.01.ODP[01] the time period for account inactivity before disabling is defined.
  • A.03.01.01.ODP[02] the time period within which to notify account managers and designated personnel or roles when accounts are no longer required is defined.
  • A.03.01.01.ODP[03] the time period within which to notify account managers and designated personnel or roles when users are terminated or transferred is defined.
  • A.03.01.01.ODP[04] the time period within which to notify account managers and designated personnel or roles when system usage or the need-to-know changes for an individual is defined.
  • A.03.01.01.ODP[05] the time period of expected inactivity requiring users to log out of the system is defined.
  • A.03.01.01.ODP[06] circumstances requiring users to log out of the system are defined.

Draws on Rev. 2 3.1.1, 3.13.3.

Left: NIST SP 800-171 Rev. 2 and 800-171A, verbatim. Right: NIST SP 800-171 Rev. 3 and 800-171A Rev. 3, verbatim, with organization-defined blanks highlighted.

Word by word

The Rev. 2 requirement compared with its Rev. 3 successor. A mechanical comparison of the two verbatim texts, not an interpretation.

removed in Rev. 3 added in Rev. 3

Rev. 2 3.1.1 → Rev. 3 03.01.01 Account Management

Limit Define the types of system access to accounts allowed and prohibited. Create, enable, modify, disable, and remove system accounts in accordance with policy, procedures, prerequisites, and criteria. Specify: Authorized users processes acting of the system, Group and role membership, and Access authorizations (i.e., privileges) for each account. Authorize access to the system based on: behalf A valid access authorization and Intended system usage. Monitor the use of authorized users, system accounts. Disable system accounts when: The accounts have expired, The accounts have been inactive for [Assignment: organization-defined time period], The accounts are no longer associated with a user or individual, The accounts are in violation of organizational policy, or Significant risks associated with individuals are discovered. Notify account managers and devices (including other systems). designated personnel or roles within: [Assignment: organization-defined time period] when accounts are no longer required. [Assignment: organization-defined time period] when users are terminated or transferred. [Assignment: organization-defined time period] when system usage or the need-to-know changes for an individual. Require that users log out of the system after [Assignment: organization-defined time period] of expected inactivity or when [Assignment: organization-defined circumstances].

6 words kept, 12 removed, 167 added. Rev. 3 statement labels omitted for the comparison.

What NIST says changed

  • New security requirement title
  • Aligned with SP 800-53, Rev 5 to provide more comprehensive detail on and foundational tasks for account management
  • Added new ODP: time period to notify personnel/roles when accounts are no longer required
  • Added new ODP: time period to notify personnel/roles when users terminated/transferred
  • Added new ODP: time period to notify personnel/roles when system usage or need-to-know changes for an indivdual
  • Added new ODP: time period of inactivity or circumstances in which users are required to log out
  • Updated discussion differentiating 03.01.01 with 03.01.10

NIST, SP 800-171 Rev. 2 to Rev. 3 change analysis, class “Significant change”. At adoption, Bedrock files this under “Rework”.

NIST's Rev. 3 discussion for 03.01.01

This requirement focuses on account management for systems and applications. The definition and enforcement of access authorizations other than those determined by account type (e.g., privileged access, non-privileged access) are addressed in <a href="#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.01.02">03.01.02</a>. System account types include individual, group, temporary, system, guest, anonymous, emergency, developer, and service. Users who require administrative privileges on system accounts receive additional scrutiny by personnel responsible for approving such accounts and privileged access. Types of accounts that organizations may prohibit due to increased risk include group, emergency, guest, anonymous, and temporary. Organizations may choose to define access privileges or other attributes by account, type of account, or a combination of both. Other attributes required for authorizing access include restrictions on the time of day, day of the week, and point of origin. When defining other system account attributes, organizations consider system requirements (e.g., system upgrades, scheduled maintenance) and mission and business requirements (e.g., time zone differences, remote access to facilitate travel requirements). Users who pose a significant security risk include individuals for whom reliable evidence indicates either the intention to use authorized access to the system to cause harm or that adversaries will cause harm through them. Close coordination among mission and business owners, system administrators, human resource managers, and legal staff is essential when disabling system accounts for high-risk individuals. Time periods for the notification of organizational personnel or roles may vary. Inactivity logout is behavior- or policy-based and requires users to take physical action to log out when they are expecting inactivity longer than the defined period. Automatic enforcement of inactivity logout is addressed by <a href="#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.01.10">03.01.10</a>.

What this means for you now

Nothing changes in what you are assessed against until a class deviation or a published rule adopts Rev. 3. Keep meeting 3.1.1 as written in Rev. 2, and if you already choose a value for the parameters above in practice, write it down where your system security plan can find it.

Bedrock CMMC shows this same comparison against your own package, with your current status on the Rev. 2 side, so the day adoption lands the migration is a review, not a rewrite.

Back to the Rev. 2 vs Rev. 3 overview

Where this page's facts come from
Rev. 2 text and objectives
bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.basicRequirement@rev2; bedrock-cmmc-api@89b8e8e:migrations/005_reference_objectives.sql#AssessmentObjective.description@rev2
Mapping and change class
bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/r2_r3_transition_map.json#r2_to_r3
Rev. 3 03.01.01
bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/rev3.json#requirements[]