The most fundamental question in cybersecurity is: “Who are you?” Before any system can enforce policy, log activity, or prevent unauthorized access, it must first identify the user.
That’s what IA.L2-3.5.1 requires: reliable identification of users, processes, and devices before access is granted.
As both a Certified CMMC Assessor and Certified CMMC MSP, we see this control as the first test of access discipline in an environment. If you can’t prove you identify users and devices before access—every downstream control is weakened.
🔐 CONTROL:
IA.L2-3.5.1 – Identify system users, processes acting on behalf of users, and devices.
✅ Assessment Objectives (from the CMMC Assessment Guide):
- System users are identified.
- Processes acting on behalf of users are identified.
- Devices are identified.
🛠️ MSP Perspective: How to Implement It
- Identify all users
- Every user must authenticate with a unique ID (no shared logins).
- Directory-based identity (Active Directory, Azure AD, Okta) preferred.
- Service accounts should be named with purpose and owner.
- Identify processes acting on behalf of users
- Examples include API tokens, scheduled tasks, service accounts, etc.
- Document each process: what it does, under whose authority, and on which system.
- Identify devices before access
- Use device registration in Azure AD or endpoint management (e.g., Intune, Jamf, MDM).
- Enforce conditional access policies to prevent unknown device access.
- Maintain an asset inventory with device names, serials, and owner mappings.
🛠️ Tip: Require all devices accessing your network or cloud to be enrolled and checked for compliance.
⚠️ Common Pitfalls
- Using generic logins (e.g., “admin” or “intern”).
- Allowing BYOD or VPN access without device registration.
- Overlooking identification of automated processes and scripts.
🧩 Final Guidance
Identification is the first link in the chain of accountability. If you can’t identify who or what is accessing your environment, you can’t apply policy, track behavior, or contain incidents. That’s why IA.L2-3.5.1 isn’t optional—it’s foundational.