Skip to content
ControlVerdict
Sign in
IA.L2-3.5.2CMMC Level 2Level 2

Authentication [CUI Data]

Submit your own example

Practice statement

Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.

Quoted verbatim from NIST SP 800-171 Rev. 2 §3.5.2.Source

The source document’s non-normative “Discussion” section is not reproduced here. ControlVerdict quotes normative text verbatim or omits it — it never paraphrases a standard. Follow the source link above for the full context.

Assessment Objectives(3)

An assessor determines each objective separately. “Mostly implemented” is not a result — every objective below has to stand on its own.

  1. [a]

    the identity of each user is authenticated or verified as a prerequisite to system access;

    1 example covers this

  2. [b]

    the identity of each process acting on behalf of a user is authenticated or verified as a prerequisite to system access; and

    1 example covers this

  3. [c]

    the identity of each device accessing or connecting to the system is authenticated or verified as a prerequisite to system access.

    1 example covers this

Objective text quoted verbatim from NIST SP 800-171A via the CMMC Level 2 assessment guide.

Implementation examples(1)

Submit your own example
  • addresses
    IA.L2-3.5.2Authentication [CUI Data]
    Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.

    • [a]

      the identity of each user is authenticated or verified as a prerequisite to system access;

    • [b]

      the identity of each process acting on behalf of a user is authenticated or verified as a prerequisite to system access; and

    • [c]

      the identity of each device accessing or connecting to the system is authenticated or verified as a prerequisite to system access.

    Nothing reaches the VDI pool without a verified user, workload, and device claim

    ControlVerdict Corpus@cv-corpusOSCJul 31, 2026
    Community is just starting — add yours. Only 2 verdicts so far.Last verdict Aug 2, 2026

    Implementation

    AO coverage. Addresses all three Authentication objectives — user, process, and device verification as a prerequisite to access. Factor strength for those authentications is described in the IA.L2-3.5.3 and IA.L2-3.5.4 examples rather than repeated here.

    Users. Every enclave entry point (virtual desktop feed, both SaaS apps, the session-host management plane) authenticates through the IdP. Legacy authentication protocols that skip modern auth are blocked tenant-wide, so there is no password-only fallback path to fail back to.

    Processes acting on behalf of users. Pipelines and integration jobs authenticate as workload identities using federated OIDC credentials or certificates. Client secrets are not issued for new integrations, and the three remaining secret-based integrations have dated migration tickets. No automation reuses a human account.

    Devices. Session hosts and endpoints receive a device certificate through MDM enrollment; the access policy requires a compliant-device claim, so a browser on an unmanaged laptop cannot obtain the desktop feed even with correct credentials. Verified sign-ins record the device object ID, which is what makes the monthly check below possible.

    Maintenance. Monthly query for any successful enclave authentication that lacked a device claim (expected result: zero, or a documented break-glass). Quarterly workload-identity attestation by each owner, and a purge of device certificates whose MDM object is gone.

    Accepted gap. One customer's file exchange accepts SSH key authentication only, with no device identity. The key lives on a single hardened transfer host — that host is effectively the authenticated device — is pinned to our egress address on the customer side, and rotates annually.

    What the evidence looks like

    • Conditional Access policies for the desktop feed and both SaaS apps
    • Tenant setting export showing legacy authentication blocked
    • Workload identity federation configuration and the secret-migration tickets
    • SCEP certificate profile plus a sign-in log sample showing device claims
    • Transfer-host exception record with key rotation history

    Environment

    Engineering services firm, ~60 CUI users. The enclave is a virtual desktop pool plus two SaaS apps; no CUI is permitted on local endpoint storage.

    Tools

    2 ratings on this revision

    • AlignedControlVerdict Implementer@cv-implementerOSCAug 2, 2026

      Across the finish line

      Clear separation of registration from day-to-day use. Good for a hybrid shop.

    • AlignedControlVerdict Assessor@cv-assessorAug 2, 2026

      Across the finish line

      Authenticator binding and recovery story are explicit. Evidence list matches what I would sample in interview.

Discussion(0)

No discussion on this control yet

Edge cases, scoping questions, and “would this pass?” scenarios belong here.

Sign in to start a thread.