Mapped to NIST 800-171 Requirement: 3.5.12
CMMC Assessment Objective: IA.L2-3.5.10[b]
What This Objective Means
This control validates that the device identifiers—such as certificates, IP addresses, MAC addresses, or hardware IDs—are technically integrated into system authentication workflows. It’s not just about knowing what identifiers exist, but ensuring systems are configured to use them during login or access requests.
This applies to:
• Endpoint authentication
• VPN and remote access
• Server-to-server or system API authentication
• Cloud access with device validation or certificates
Why It Matters
Using device identifiers in authentication helps:
• Confirm the trustworthiness of the device connecting to your environment
• Reduce the risk of impersonation or rogue device access
• Enforce Zero Trust principles
• Support multi-layered authentication (device + user)
• Block access from unregistered or unapproved endpoints
Without implementation, device trust becomes an unvalidated assumption.
How to Implement It
1. Configure Certificate-Based Authentication
• Use client-side X.509 certificates for VPN or endpoint access
• Enforce certificate validation at gateways or firewalls
2. Apply MAC or IP Address Restrictions
• Filter allowed device access via:
◦ VPN concentrators
◦ NAC (Network Access Control) systems
◦ Firewall rules
3. Implement Hardware-Based Device ID Checks
• Use TPM or BIOS serial verification in endpoint tools
• Require device registration in MDM or endpoint protection platforms
4. Ensure Identity Providers Enforce Device Trust
• Use Conditional Access Policies in Azure AD, Okta, or similar platforms to validate managed devices
5. Test Enforcement
• Attempt to log in from an unregistered or unmanaged device
• Confirm access is blocked or challenged
Evidence the Assessor Will Look For
• VPN or firewall configurations showing certificate or MAC/IP enforcement
• Screenshots of device trust policies in identity providers
• Logs showing successful/failed authentication attempts based on device ID
• Documentation linking device identifiers to authentication settings
• Endpoint management console settings enforcing device trust
Common Gaps
• Certificates deployed but not validated during authentication
• MAC/IP filters present but not actively maintained
• Device-based authentication used in some systems but not others
• No technical enforcement — only policy-level intent
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Enforcing certificate-based device authentication at the enclave boundary
• Validating device identifiers before access is granted
• Blocking unauthorized systems from connecting—even with valid user credentials
• Logging all device authentication activity for audit visibility
• Integrating with endpoint and identity platforms to support Zero Trust and managed-device policies
With Cuick Trac, device-based access is secure, traceable, and enforced by design.
Final CTA
If you trust the device, prove it. If you don’t, block it.
Schedule a Cuick Trac demo to ensure device identity is part of your authentication strategy—not just a footnote.