NIST SP 800-171 REV. 3 Identification and Authentication

• 03.05.01 User Identification and Authentication

  Uniquely identify and authenticate system users, and associate that unique identification with processes acting on behalf of those users.

• 03.05.02 Device Identification and Authentication

  Uniquely identify and authenticate [Assignment: organization-defined devices or types of devices] before establishing a system connection.

• 03.05.03 Multi-Factor Authentication

  Implement multi-factor authentication for access to privileged and non-privileged accounts.

• 03.05.04 Replay-Resistant Authentication

  Implement replay-resistant authentication mechanisms for access to privileged and non-privileged accounts.

• 03.05.05 Identifier Management

  Receive authorization from organizational personnel or roles to assign an individual, group, role, service, or device identifier.

• 03.05.07 Password Management

  Maintain a list of commonly-used, expected, or compromised passwords, and update the list [Assignment: organization-defined frequency] and when organizational passwords are suspected to have been compromised.

• 03.05.11 Authentication Feedback

  Obscure feedback of authentication information during the authentication process.

• 03.05.12 Authenticator Management

  Verify the identity of the individual, group, role, service, or device receiving the authenticator as part of the initial authenticator distribution.

Need help putting this into practice? See our NIST SP 800-171 & CMMC compliance services or read our NIST SP 800-171 & CMMC articles.