Mapped to NIST 800-171 Requirement: 3.5.10
CMMC Assessment Objective: IA.L2-3.5.8[a]
What This Objective Means
This control focuses on creating a clear, up-to-date inventory of the types of authentication mechanisms your organization uses to secure access to its systems.
Examples of authentication mechanisms include:
• Username + password
• Multifactor authentication (MFA)
• Public key infrastructure (PKI) or digital certificates
• Biometric authentication (e.g., fingerprint, facial recognition)
• Smart cards or hardware tokens
• API tokens or application-level keys
You must document which are in use, and where they are applied.
Why It Matters
If you don’t know how users and systems authenticate, you can’t:
• Confirm authentication meets policy or compliance requirements
• Enforce replay resistance or MFA
• Detect weak or misused mechanisms
• Apply consistent protections across all access points
Authentication inventory is the foundation for secure access control.
How to Implement It
1. Perform a System Audit
• Identify all systems, platforms, and applications that support authentication
• Document the access method for each (e.g., GUI login, API access, SSH)
2. Record the Authentication Mechanisms
• For each system or platform, capture:
◦ Mechanism type (e.g., password, token, biometric)
◦ Authentication provider or method (e.g., Active Directory, Azure AD, SAML, LDAP)
◦ Any MFA or second-factor details
3. Include Service Accounts and APIs
• Don’t forget system-to-system communication
• Identify machine-based authentication (e.g., certificate-based, key files, bearer tokens)
4. Maintain Documentation
• Update your System Security Plan (SSP) or Authentication Architecture documentation
• Include diagrams if possible to visualize flow and coverage
Evidence the Assessor Will Look For
• A complete list or matrix of authentication mechanisms used across your environment
• Documentation showing where and how each is applied
• Reference to authentication methods in the SSP, IR Plan, or Access Control Policy
• Screenshots or exports from identity provider configurations
• Logs or test results confirming types of login mechanisms
Common Gaps
• No centralized documentation of authentication methods
• Inconsistent mechanisms across similar systems
• Legacy platforms using weak or deprecated authentication
• Missing service account authentication details
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Maintaining a standardized set of secure authentication mechanisms across all enclave access points
• Supporting MFA, certificate-based, and federated authentication models
• Providing visibility into the exact methods used per system or access type
• Helping document authentication across both user and machine-based workflows
• Aligning with modern best practices and compliance frameworks
With Cuick Trac, you always know how access is granted—and how it’s protected.
Final CTA
Authentication is your first line of defense. Knowing how it works is step one.
Schedule a Cuick Trac demo to inventory, standardize, and secure your authentication approach.