Identification and Authentication Controls Under CMMC 2.0

Authentication is the front door of every security architecture. In CUI environments, it is also one of the most consistently under-implemented control domains — not because organizations fail to deploy MFA, but because they deploy MFA for some users and some systems and treat that partial deployment as full IA compliance.

CMMC 2.0 IA domain requirements cover more than multi-factor authentication. They address unique identification, authenticator management, privileged account authentication, device authentication, and the replay-resistance requirements that make authentication actually resistant to the credential-based attacks that define the modern threat landscape. Organizations that scope IA compliance to their MFA deployment have addressed one requirement and left the others for assessors to find.

Overview

CMMC Level 2 IA domain requirements map directly to NIST 800-171 Section 3.5 — nine practices that collectively require unique identification for all users and devices, multi-factor authentication for network access and privileged accounts, authenticator management that prevents weak and reused credentials, and replay-resistant authentication that resists the session hijacking and credential theft attacks that phishing, infostealers, and MFA fatigue campaigns exploit.

Unique identification for every user — no shared accounts, no service accounts used by multiple people
MFA required for all network access to CUI systems, not just privileged accounts
Authenticator management — password complexity, rotation, and history controls applied consistently
Privileged account authentication requires MFA with additional controls beyond standard user requirements
Device authentication required for systems-to-systems connections that access CUI

The 5 Why’s

Why does CMMC IA compliance require more than deploying MFA for user accounts? MFA for user accounts addresses IA.3.083 (multi-factor authentication for network access). It does not address IA.1.076 (unique identification), IA.1.077 (authenticator management for passwords), IA.3.083’s privileged account extension, IA.3.084 (replay-resistant authentication), or the device authentication requirements. Each of those is a separate practice with its own implementation requirements. MFA deployment is one of nine — not a proxy for all nine.
Why does shared account usage create both IA compliance failures and security risks simultaneously? CMMC IA.1.076 requires unique identification for users and processes acting on behalf of users. Shared accounts — generic admin accounts, shared service accounts used by multiple staff members — make individual attribution of actions impossible, which also makes the audit trail requirement under CMMC AU effectively unenforceable. Shared accounts are a compliance failure and a forensic investigation failure simultaneously.
Why does privileged account authentication require additional controls beyond standard MFA? Privileged accounts have elevated access that makes credential compromise more consequential. CMMC IA requirements for privileged account management, read alongside AC.2.007’s privileged account controls, require that administrative accounts are managed with heightened authentication requirements — dedicated admin accounts separate from standard user accounts, stronger authentication mechanisms, and session time limits that reduce the window of exposure for compromised privileged credentials.
Why is replay-resistant authentication specifically required under CMMC, and what does it mean operationally? Replay attacks use captured authentication tokens — session cookies, Kerberos tickets, NTLM hashes — to authenticate without knowing the underlying credential. Standard MFA that protects the login event does not protect against replay attacks that bypass the login event entirely. CMMC IA.3.084 requires replay-resistant authentication mechanisms — specifically, mechanisms that use nonces, time stamps, or challenge-response that prevent captured tokens from being reused. This is not satisfied by SMS MFA alone; it requires authentication protocols with inherent replay resistance.
Why does device authentication matter for CMMC IA compliance in CUI environments? CUI systems that authenticate users through strong MFA but do not authenticate the devices connecting to them are vulnerable to access from unmanaged, potentially compromised devices that carry valid user credentials. CMMC IA.3.085 requires that systems and devices accessing CUI environments are authenticated — not just the users operating them. This requires device identity management infrastructure: certificates, device enrollment, and enforcement that blocks unregistered devices from reaching CUI systems regardless of user credential strength.

Implementing CMMC IA Domain Controls

IA.1.076 — Unique Identification

Audit all user accounts across CUI-touching systems for shared account usage
Eliminate shared accounts; create individual accounts for every user, including contractors and third parties
Review service accounts — automated processes that access CUI must use dedicated service accounts, not accounts shared with human users or across multiple services
Verify that account naming conventions support individual attribution in audit logs

IA.1.077 — Authenticator Management

Implement password complexity requirements that meet NIST 800-63B current guidance: length-based strength (minimum 12 characters), no complexity requirements that produce predictable patterns, blacklisting of known compromised passwords
Enforce password history to prevent recycling of recent passwords
Implement account lockout after failed authentication attempts
Disable default credentials on all devices and systems before deployment

IA.3.083 — Multi-Factor Authentication for Network Access

MFA required for all users accessing CUI systems remotely — not limited to administrative users
MFA required for all privileged account usage, including on-premises privileged access
MFA solution must be phishing-resistant for high-privilege accounts — FIDO2 hardware keys or certificate-based authentication rather than SMS or push notification MFA that is vulnerable to MFA fatigue and SIM swap attacks

IA.3.084 — Replay-Resistant Authentication

Audit current authentication protocols for replay resistance — NTLM is not replay-resistant; Kerberos with proper configuration and modern protocols provide better replay resistance
For remote access, ensure that authentication sessions use replay-resistant token binding or time-limited tokens
Evaluate hardware security key deployment for privileged accounts where replay resistance is critical

IA.3.085 — Device Identification and Authentication

Implement device certificate infrastructure or endpoint management enrollment for all devices accessing CUI systems
Configure CUI system access to require device certificate or enrollment status as a condition alongside user MFA
Block unmanaged devices from reaching CUI systems regardless of user credential presentation

Common IA Assessment Findings

Organizations preparing for CMMC assessment frequently discover these IA gaps:

Generic admin accounts shared across IT staff not yet eliminated
MFA deployed for remote access but not enforced for on-premises privileged account use
Service accounts using human user credentials rather than dedicated service identities
Password policies that meet minimum length requirements but permit common dictionary-attackable patterns
Device authentication not implemented — CUI systems reachable from any enrolled-user device without device identity verification

Final Takeaway

CMMC IA domain compliance is not a technology deployment exercise — it is an identity architecture decision. The nine practices that make up the IA domain collectively require that every user, every privileged account, and every device accessing CUI systems is uniquely identified, strongly authenticated with replay-resistant mechanisms, and managed with the authenticator lifecycle controls that prevent credential compromise from producing prolonged unauthorized access.

Organizations that implement that architecture do not just pass IA assessment. They operate environments where the credential-based attacks that dominate the threat landscape against DIB contractors produce contained, detectable incidents rather than undetected, persistent access.

Implement CMMC IA Controls With Mindcore Technologies

Mindcore Technologies works with DIB contractors to design and implement CMMC IA domain controls — unique identification architecture, MFA deployment with phishing-resistant options for privileged accounts, device authentication infrastructure, and authenticator management policies that produce IA compliance across the full CUI environment.

Talk to Mindcore Technologies About CMMC Identification and Authentication Controls →

Contact our team to assess your current IA implementation against CMMC requirements and build the identity architecture your assessment requires.