IA.L2-3.5.5
Identifier Reuse
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee IA.L2-3.5.5 in the reference catalog with its NIST cross-references
Official requirement
Prevent reuse of identifiers for a defined period.
Assessment objectives
a. a period within which identifiers cannot be reused is defined; and
b. reuse of identifiers is prevented within the defined period.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Prevent account identifiers from being reused for the defined period.
Implementation example
Example from the source assessment guide (not a mandatory implementation): As a system administrator, you maintain a central directory/domain that holds the accounts for users, computers, and network devices. As part of your job, you issue unique usernames (e.g., [email protected]) for the staff to access resources. When you issue staff computers you also rename the computer to reflect to whom it is assigned ( e.g., riley-laptop01). Riley has recently left the organization, so you must manage the former staff member ’s account. Incidentally, their replacement is also named Riley . In the directory , you do not assign the previous account to the new user, as policy has defined an identifier reuse period of 24 months [a]. In accordance with policy, you create an account called riley02 [b]. This account is assigned the appropriate permissions for the new user. A new laptop is also provided with the identifier of riley02-laptop01.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Identification and authentication policy; system security plan; procedures addressing authenticator management; procedures addressing user identification and authentication; system design documentation; list of system authenticator types; system configuration settings and associated documentation; change control records associated with managing system authenticators; system audit logs and records; other relevant documents or records
Common mistakes
Reassigning a departed worker's username without considering identifier-reuse restrictions.