IA.L2-3.5.1
Identification [CUI Data]
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee IA.L2-3.5.1 in the reference catalog with its NIST cross-references
Official requirement
Identify system users, processes acting on behalf of users, and devices.
Assessment objectives
a. system users are identified;
b. processes acting on behalf of users are identified; and
c. devices accessing the system are identified.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Uniquely identify users, processes acting for users, and devices.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You want to make sure that all employees working on a project can access important information about it. Because this is work for the DoD and may contain CUI, you also need to prevent employees who are not working on that project from being able to access the information. You assign each employee is assigned a unique user ID, which they use to log into the system [a].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Identification and authentication policy; procedures addressing user identification and authentication; system security plan, system design documentation; system configuration settings and associated documentation; system audit logs and records; list of system accounts; other relevant documents or records
Common mistakes
Identifying employees but overlooking automated processes and device identities.