IA.L2-3.5.1 Identification
Assigning unique identifiers to every user, process acting for a user, and device that accesses the system. Covers identifier schemes, the account lists assessors check, and the Level 1 counterpart for FCI.
IA Identification and authentication
The 11 CMMC Level 2 identification and authentication requirements: identifying and authenticating users, processes and devices, multifactor and replay-resistant authentication, identifier management and password rules.
IA.L2-3.5.2 Authentication
Verifying the identity of each user, process and device before it is allowed access, including replacing default credentials. Covers authenticator management, evidence and the Level 1 counterpart.
IA.L2-3.5.3 Multifactor authentication
Requiring MFA for local and network access to privileged accounts and for network access to non-privileged accounts. One of only two Level 2 requirements that 32 CFR 170.24 scores with partial credit.
IA.L2-3.5.4 Replay-resistant authentication
Using authentication mechanisms that resist replay of captured login information for network access to privileged and non-privileged accounts, such as challenge-response or ticket-based protocols.
IA.L2-3.5.5 Identifier reuse
Preventing user, group, role and device identifiers from being reused for a defined period, so a new account cannot inherit the history or access of an old one.
IA.L2-3.5.6 Identifier handling
Disabling identifiers after a defined period of inactivity so unused accounts cannot be exploited. Covers setting the inactivity period, automated disabling and account review evidence.
IA.L2-3.5.7 Password complexity
Defining and enforcing minimum password complexity and a minimum number of changed characters whenever a new password is created. Covers password policy settings and how assessors verify enforcement.
IA.L2-3.5.8 Password reuse
Prohibiting the reuse of passwords for a specified number of generations. Covers password history settings and the configuration evidence assessors examine.
IA.L2-3.5.9 Temporary passwords
Allowing temporary passwords for system logon only with an immediate change to a permanent password at first use. Covers account provisioning settings and evidence.
IA.L2-3.5.10 Cryptographically-protected passwords
Storing and transmitting passwords only in cryptographically protected form, for example salted one-way hashes in storage and encrypted channels in transit. A 5-point requirement in the scoring methodology.
IA.L2-3.5.11 Obscure feedback
Obscuring authentication information, such as password characters, while it is entered, under a defined policy that may allow brief display on small devices.
