Identification and Authentication is about proving that every user, process and device is who it claims to be before it gets access. Its eleven requirements include the multifactor authentication requirement 3.5.3, the second most-failed requirement in DIBCAC's published data and one of only two requirements in the standard with partial credit.
Most of the family is password and identifier hygiene that modern identity platforms handle by default. The points are concentrated in identification, authentication, MFA and password protection.
What the Identification and Authentication family covers
Identification and Authentication contains 11 requirements, numbered 3.5.1 to 3.5.11 in NIST SP 800-171 Revision 2. In CMMC Level 2 they carry the practice prefix IA.L2, so 3.5.1 appears as IA.L2-3.5.1.
The family covers identifying and authenticating users, processes and devices (3.5.1, 3.5.2), MFA and replay resistance (3.5.3, 3.5.4), identifier management (3.5.5, 3.5.6) and password rules (3.5.7–3.5.11). It works alongside Access Control, which decides what an authenticated identity may do.
| Requirement | What it requires | SPRS points | POA&M |
|---|---|---|---|
| 3.5.1 | Identify system users, processes acting on behalf of users, and devices | 5 | No |
| 3.5.2 | Authenticate the identities of users, processes or devices before allowing access | 5 | No |
| 3.5.3 | Use multifactor authentication for local and network access to privileged accounts and network access to non-privileged accounts | 5 (3 if partial) | No |
| 3.5.4 | Employ replay-resistant authentication for network access to privileged and non-privileged accounts | 1 | Eligible |
| 3.5.5 | Prevent reuse of identifiers for a defined period | 1 | Eligible |
| 3.5.6 | Disable identifiers after a defined period of inactivity | 1 | Eligible |
| 3.5.7 | Enforce a minimum password complexity and change of characters when new passwords are created | 1 | Eligible |
| 3.5.8 | Prohibit password reuse for a specified number of generations | 1 | Eligible |
| 3.5.9 | Allow temporary passwords for logons only with an immediate change to a permanent password | 1 | Eligible |
| 3.5.10 | Store and transmit only cryptographically-protected passwords | 5 | No |
| 3.5.11 | Obscure feedback of authentication information | 1 | Eligible |
Point values from the DoD Assessment Methodology v1.2.1. POA&M eligibility under 32 CFR 170.21.
What it costs you in SPRS points
The family puts 27 of the 313 deductible points in the SPRS score at risk. The five-point requirements are 3.5.1, 3.5.2, 3.5.3 and 3.5.10. The remaining 7 are worth one point each.
3.5.3 is worth five points if MFA is not implemented and three if it is partially implemented — for example, applied to network access but not to privileged local access. The partial-credit rule does not make the gap deferrable: only 3.13.11 has a deferral exception.
Why MFA fails assessments
The requirement has three parts: MFA for local access to privileged accounts, for network access to privileged accounts, and for network access to non-privileged accounts. Organizations usually cover cloud and VPN logons for ordinary users and then miss local administrator logons on servers and workstations, break-glass accounts, or privileged access through a second path such as a remote desktop gateway or an out-of-band management interface.
The fix starts with an inventory of every privileged identity and every access path, then applies MFA to each and records the evidence. 3.5.4 also requires replay-resistant authentication for network access, which modern protocols and phishing-resistant methods provide.
Implementation priorities for Identification and Authentication
Consolidate identities into as few directories as possible so that one policy governs passwords, identifier reuse and inactivity. Enumerate every privileged account and every network access path and apply MFA to each, favoring phishing-resistant methods. Confirm that legacy protocols that send passwords in clear text are disabled, which addresses 3.5.10. Record the configuration of each item as evidence, dated, because identity settings drift over time.
What you can and cannot defer
Under 32 CFR 170.21 only one-point requirements may be placed on a POA&M, with the single exception of 3.13.11 when encryption exists but is not FIPS-validated. In this family that makes 3.5.4, 3.5.5, 3.5.6, 3.5.7, 3.5.8, 3.5.9 and 3.5.11 eligible for deferral.
Seven password and identifier requirements are deferrable. Most identity platforms satisfy them through configuration, so they rarely need to be deferred at all.
Evidence assessors expect
Assessors work at the level of the objectives in NIST SP 800-171A and use examine, interview and test. For this family, have the following ready — the full evidence package checklist covers all 14 families:
- A list of privileged accounts, including local, domain, cloud, service and emergency accounts.
- MFA configuration for each access path, with screenshots or exports dated.
- Password policy settings for complexity, reuse and temporary passwords.
- Identifier reuse and inactivity settings.
- Proof that passwords are stored and transmitted only in protected form.
Frequently asked questions
Does SMS count as a second factor?
NIST SP 800-171 does not prohibit it, but SMS is weak against interception and phishing. Authenticator apps, hardware keys or certificate-based methods are stronger and easier to defend.
Do local admin accounts need MFA?
Yes. 3.5.3 covers local access to privileged accounts. This is the most commonly missed part of the requirement.
Can MFA go on a POA&M?
Not under the CMMC rule. It is a five-point requirement, and its partial-credit status does not carry a deferral exception.
What does replay-resistant authentication mean for 3.5.4?
Authentication that cannot be captured and reused by an attacker, such as protocols using nonces or challenge-response, Kerberos, and modern MFA methods. Basic authentication over the network does not qualify.