IA.L1-b.1.vi
Authentication [FCI Data]
Source and approval
CMMC Assessment Guide — Level 1 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee IA.L1-b.1.vi in the reference catalog with its NIST cross-references
Official requirement
Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.
Assessment objectives
a. the identity of each user is authenticated or verified as a prerequisite to system access;
b. the identity of each process acting on behalf of a user is authenticated or verified as a prerequisite to system access; and
c. the identity of each device accessing or connecting to the system is authenticated or verified as a prerequisite to system access.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Verify that a claimed identity is authentic before allowing access.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are in charge of purchasing laptops that will store FCI. You know that some laptops come with a default username and password. You notify IT that all default passwords should be reset prior to laptop use [a]. You ask IT to explain the importance of resetting default passwords and convey how easily they are discovered using internet searches during next week’s cybersecurity awareness training. Example 2 Your company decides to use cloud services for email and other capabilities that will transmit FCI. Upon reviewing this requirement, you realize every user or device that connects to the cloud service must be authenticated. As a result, you work with your cloud service provider to ensure that only properly authenticated users and devices are allowed to connect to the system [a,c].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Identification and authentication policy; system security plan; procedures addressing authenticator management; procedures addressing user identification and authentication; system design documentation; list of system authenticator types; system configuration settings and associated documentation; change control records associated with managing system authenticators; system audit logs and records; other relevant documents or records
Common mistakes
Creating accounts without enforcing authentication for the people, processes, and devices that use them.