Mapped to NIST 800-171 Requirement: 3.5.13
CMMC Assessment Objective: IA.L2-3.5.11
What This Control Means
Your systems must be configured so that each user has their own unique account and must authenticate using their own credentials before gaining access.
This includes:
• End users
• Administrators
• Developers
• Contractors
• Service/system accounts
Shared credentials, generic logins (e.g., admin, user1), or anonymous access are not acceptable under this control.
Why It Matters
Without unique identification:
• There’s no accountability—you can’t determine who did what
• Insider threats are harder to detect and prevent
• Access can’t be effectively revoked for specific users
• Audit trails and compliance reports become unreliable
Authentication ensures the user is who they claim to be. Unique IDs ensure you can trace their actions.
How to Implement It
1. Create Unique Accounts for All Users
• One user = one account. No shared logins.
• Disable or eliminate generic accounts
2. Require Authentication for All Access
• Enforce login credentials for all system entry points
• Use MFA, passwords, certificates, or other secure methods
3. Include Non-Human Accounts
• Assign unique identifiers for system and service accounts
• Track and control their use the same as user accounts
4. Document in Policies
• Include procedures in your Access Control Policy and System Security Plan (SSP)
5. Monitor and Audit
• Regularly review user activity logs and ensure actions are tied to specific, named users
Evidence the Assessor Will Look For
• User account lists showing one account per person
• Authentication system configurations
• Screenshots or exports from directory services (e.g., Active Directory, Azure AD)
• Policies prohibiting shared or anonymous accounts
• Audit logs mapping actions to unique user IDs
Common Gaps
• Shared administrator accounts
• Generic usernames still in use
• Service accounts not documented or controlled
• No logging or correlation between user identity and system activity
How Cuick Trac Helps
Cuick Trac supports this control by:
• Enforcing unique usernames and authentication credentials for all access
• Blocking access from shared or anonymous accounts
• Logging all user activity with unique IDs tied to specific individuals
• Helping organizations manage and monitor both user and system/service accounts
• Providing a consistent identity model across enclave access points
With Cuick Trac, every user is identified, authenticated, and accountable.
Final CTA
Security starts with knowing who’s in the system—and proving it.
Schedule a Cuick Trac demo to ensure every action in your environment is traceable to a uniquely authenticated user.