Access Control · AC.L1-b.1.i(a)
Authorized users are identified
An assessment objective under requirement AC.L1-b.1.i, Authorized Access Control, in the Access Control domain.
Objective Statement
Authorized users are identified
Objective identity
- Framework
- Cybersecurity Maturity Model Certification · Level 1
- Domain
- Access Control (AC)
- Objective ID
- AC.L1-b.1.i(a)
- Parent Requirement
- AC.L1-b.1.i · Limit system access to authorized users
Assessment Procedures
The official government assessment method for this objective, exactly as printed in the DoD CMMC Assessment Guide, Level 1, which reprints it from NIST SP 800-171A (June 2018). An assessor examines artifacts, interviews people, and tests mechanisms to determine the result.
Examine
- Access control policy
- Procedures addressing account management
- System security plan
- System design documentation
- System configuration settings and associated documentation
- List of active system accounts and the name of the individual associated with each account
- Notifications or records of recently transferred, separated, or terminated employees
- List of conditions for group and role membership
- List of recently disabled system accounts along with the name of the individual associated with each account
- Access authorization records
- Account management compliance reviews
- System monitoring records
- System audit logs and records
- List of devices and systems authorized to connect to organizational systems
- Other relevant documents or records
Interview
- Personnel with account management responsibilities
- System or network administrators
- Personnel with information security responsibilities
Test
- Organizational processes for managing system accounts
- Mechanisms for implementing account management
Related Objectives
- AC.L1-b.1.i(b)processes acting on behalf of authorized users are identified
- AC.L1-b.1.i(c)devices (and other systems) authorized to connect to the system are identified
- AC.L1-b.1.i(d)system access is limited to authorized users
- AC.L1-b.1.i(e)system access is limited to processes acting on behalf of authorized users
- AC.L1-b.1.i(f)system access is limited to authorized devices (including other systems)
Source Authority
- Primary Authority
- NIST SP 800-171A (June 2018)
- Official Text
- Requirement Authority
- FAR 52.204-21(b)(1)
- Program Authority
- 32 CFR 170.15(c)(1)(ii) Table 2
- Framework Version
- CMMC Assessment Guide, Level 1 v2.13 (September 2024)
- Effective Date
- 2024-12-16
- Last Verified
- 2026-10-02
Cite This Page
“CMMC AC.L1-b.1.i(a): Authorized users are identified.” AssessrLog, a product of ProfytAI Pte. Ltd.. Last verified 2026-10-02. https://assessrlog.com/cmmc/objectives/authorized-users-are-identified/
Build the Record Behind This
AssessrLog logs the determination for this objective with its evidence and source record, so your Level 1 self-assessment stays traceable and ready to affirm. The MET, NOT MET, or N/A call is always yours to make.