IA.L1-b.1.v
Identification [FCI Data]
Source and approval
CMMC Assessment Guide — Level 1 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee IA.L1-b.1.v in the reference catalog with its NIST cross-references
Official requirement
Identify information system users, processes acting on behalf of users, or devices.
Assessment objectives
a. system users are identified;
b. processes acting on behalf of users are identified; and
c. devices accessing the system are identified.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Identify each person, process, and device before granting access.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You want to make sure that all employees working on a project can access important information about it. Because this is work for the DoD and contains FCI, you also need to prevent employees who are not working on that project from being able to access the information. You assign each employee a unique user ID, which they use to log on to the system [a].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Identification and authentication policy; procedures addressing user identification and authentication; system security plan, system design documentation; system configuration settings and associated documentation; system audit logs and records; list of system accounts; other relevant documents or records
Common mistakes
Using shared identities that prevent a system activity from being associated with its actual actor.