What this requirement asks
Identify system users, processes acting on behalf of users, and devices.
This is a CMMC Level 2 requirement in the Identification & Authentication family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (3)
- 3.5.1[a] — system users are identified
- 3.5.1[b] — processes acting on behalf of users are identified
- 3.5.1[c] — devices accessing the system are identified
What an assessor examines
Examine:
- Identification and authentication policy
- procedures addressing user identification and authentication
- system security plan, system design documentation
- system configuration settings and associated documentation
- system audit logs and records
- list of system accounts
- other relevant documents or records
Interview:
- Personnel with system operations responsibilities
- personnel with information security responsibilities
- system or network administrators
- personnel with account management responsibilities
- system developers
Test:
- Organizational processes for uniquely identifying and authenticating users
- mechanisms supporting or implementing identification and authentication capability
Evidence that defends it
Show unique identifiers and managed device identities
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.