03.05.01 User identification and authentication
Uniquely identifying and authenticating every system user, associating that identity with processes acting for the user, and re-authenticating users in defined circumstances.
03.05 Identification and authentication
Rev. 3 identification and authentication requirements: unique user and device identity, multi-factor and replay-resistant authentication, identifier, password and authenticator management, and authentication feedback.
03.05.02 Device identification and authentication
Uniquely identifying and authenticating defined devices or device types before they connect to the system, and the device credentials and network access mechanisms that support it.
03.05.03 Multi-factor authentication
Requiring multi-factor authentication for access to both privileged and non-privileged accounts; its Rev. 2 counterpart is one of two requirements that can earn partial credit in DoD and CMMC scoring.
03.05.04 Replay-resistant authentication
Using authentication mechanisms that resist replay of recorded authentication messages, such as nonce or challenge-based protocols, for access to privileged and non-privileged accounts.
03.05.05 Identifier management
Managing identifiers for individuals, groups, roles, services and devices: authorization before assignment, unique assignment, no reuse for a defined period, and marking each individual's status, such as contractor or foreign national.
03.05.07 Password management
Rules for systems that use passwords: screening new passwords against a list of common, expected or compromised passwords, protecting passwords in transit and storage, a new password after account recovery and defined composition rules. Rev. 3 folded Rev. 2's 3.5.10 into it.
03.05.11 Authentication feedback
Obscuring authentication information, such as typed passwords, while users authenticate so it cannot be observed by others.
03.05.12 Authenticator management
Managing passwords, tokens, keys and other authenticators from issue to revocation: identity checks at distribution, initial content, procedures for lost or compromised authenticators, changing defaults, scheduled refresh and protecting authenticator content; new in Rev. 3.
