Skip to content
ControlVerdict
Sign in
IA.L2-3.5.5CMMC Level 2Level 2

Identifier Reuse

Submit your own example

Practice statement

Prevent reuse of identifiers for a defined period.

Quoted verbatim from NIST SP 800-171 Rev. 2 §3.5.5.Source

The source document’s non-normative “Discussion” section is not reproduced here. ControlVerdict quotes normative text verbatim or omits it — it never paraphrases a standard. Follow the source link above for the full context.

Assessment Objectives(2)

An assessor determines each objective separately. “Mostly implemented” is not a result — every objective below has to stand on its own.

  1. [a]

    a period within which identifiers cannot be reused is defined; and

    1 example covers this

  2. [b]

    reuse of identifiers is prevented within the defined period.

    1 example covers this

Objective text quoted verbatim from NIST SP 800-171A via the CMMC Level 2 assessment guide.

Implementation examples(1)

Submit your own example
  • addresses
    IA.L2-3.5.5Identifier Reuse
    Prevent reuse of identifiers for a defined period.

    • [a]

      a period within which identifiers cannot be reused is defined; and

    • [b]

      reuse of identifiers is prevented within the defined period.

    24-month identifier hold, with mail aliases reserved permanently

    ControlVerdict Corpus@cv-corpusOSCJul 31, 2026
    Community is just starting — add yours. No verdicts yet.

    Implementation

    AO coverage. Addresses both Identifier Reuse objectives: the non-reuse period is defined, and reuse is prevented within it.

    Defined period. Account identifiers (UPN, sAMAccountName, MES user ID, and employee number) cannot be reused for 24 months after the account is deleted. Mail aliases are stricter: never reused, because misdirected mail is the failure mode we actually saw.

    Enforcement. Deletion writes a tombstone row to an identifier reservation table with the retire date. The provisioning workflow checks that table before it will create anything, and a candidate identifier that collides gets a numeric suffix rather than the retired string. Rehires get their original identifier back only when the reservation row maps to the same HR person record — same identifier, same human, no ambiguity in old audit records.

    Why it matters here. With this much churn, log entries from two years ago must still resolve to one person. The reservation table is exported with the audit archive so an investigator reading old records can resolve an identifier that no longer exists in the directory.

    Maintenance. Quarterly negative test: attempt to provision an identifier retired within the window and confirm the workflow refuses. Annual review of table growth and of the 24-month figure against the audit retention period (the hold must not be shorter than retention).

    Accepted gap. The shop MES caps user IDs at eight characters, so collisions are frequent and suffixes get ugly. The reservation table covers MES IDs too, and the suffix pattern is documented; the alternative — reusing short IDs — was rejected.

    What the evidence looks like

    • Written identifier reuse policy stating the 24-month period and the alias rule
    • Reservation table schema and a sample export with retire dates
    • Provisioning workflow logic or code path showing the collision check
    • Quarterly negative-test ticket showing provisioning refused a retired identifier

    Environment

    OSC with heavy rehire and contractor churn (~40% of the workforce turns over yearly). The HR system is the authoritative person record; provisioning is automated from it.

    Tools

Discussion(0)

No discussion on this control yet

Edge cases, scoping questions, and “would this pass?” scenarios belong here.

Sign in to start a thread.