Identification and Authentication · IA.L1-b.1.vi(a)
The identity of each user is authenticated or verified as a prerequisite to system access
An assessment objective under requirement IA.L1-b.1.vi, Authentication, in the Identification and Authentication domain.
Objective Statement
The identity of each user is authenticated or verified as a prerequisite to system access
Objective identity
- Framework
- Cybersecurity Maturity Model Certification · Level 1
- Domain
- Identification and Authentication (IA)
- Objective ID
- IA.L1-b.1.vi(a)
- Parent Requirement
- IA.L1-b.1.vi · Authenticate users before granting access
Assessment Procedures
The official government assessment method for this objective, exactly as printed in the DoD CMMC Assessment Guide, Level 1, which reprints it from NIST SP 800-171A (June 2018). An assessor examines artifacts, interviews people, and tests mechanisms to determine the result.
Examine
- Identification and authentication policy
- System security plan
- Procedures addressing authenticator management
- Procedures addressing user identification and authentication
- System design documentation
- List of system authenticator types
- System configuration settings and associated documentation
- Change control records associated with managing system authenticators
- System audit logs and records
- Other relevant documents or records
Interview
- Personnel with authenticator management responsibilities
- Personnel with information security responsibilities
- System or network administrators
Test
- Mechanisms supporting or implementing authenticator management capability
Related Objectives
Source Authority
- Primary Authority
- NIST SP 800-171A (June 2018)
- Official Text
- Requirement Authority
- FAR 52.204-21(b)(1)
- Program Authority
- 32 CFR 170.15(c)(1)(ii) Table 2
- Framework Version
- CMMC Assessment Guide, Level 1 v2.13 (September 2024)
- Effective Date
- 2024-12-16
- Last Verified
- 2026-10-02
Cite This Page
“CMMC IA.L1-b.1.vi(a): The identity of each user is authenticated or verified as a prerequisite to system access.” AssessrLog, a product of ProfytAI Pte. Ltd.. Last verified 2026-10-02. https://assessrlog.com/cmmc/objectives/the-identity-of-each-user-is-authenticated-or-verified-as-a/
Build the Record Behind This
AssessrLog logs the determination for this objective with its evidence and source record, so your Level 1 self-assessment stays traceable and ready to affirm. The MET, NOT MET, or N/A call is always yours to make.