# NIST 800-171 3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.

- Source: https://support.icompaas.com/support/solutions/articles/62000229290-nist-800-171-3-5-2-authenticate-or-verify-the-identities-of-users-processes-or-devices-as-a-prer
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST](https://support.icompaas.com/support/solutions/62000112528) › [800-171](https://support.icompaas.com/support/solutions/folders/62000168440)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:**   

Individual authenticators include the following: passwords, key cards, cryptographic devices, and one-time password devices. Initial authenticator content is the actual content of the authenticator, for example, the initial password. In contrast, the requirements about authenticator content include the minimum password length. Developers ship system components with factory default authentication credentials to allow for initial installation and configuration. Default authentication credentials are often well known, easily discoverable, and present a significant security risk.  Systems support authenticator management by organization-defined settings and restrictions for various authenticator characteristics including minimum password length, validation time window for time synchronous one-time tokens, and number of allowed rejections during the verification stage of biometric authentication. Authenticator management includes issuing and revoking, when no longer needed, authenticators for temporary access such as that required for remote maintenance. Device authenticators include certificates and passwords.  \[SP 800-63-3\] provides guidance on digital identities. 

  

**Priority**: High  

  

**Category**:  Identity & Access Management (IAM) 

  

**Services Associated with AWS:**  

-   AWS Identity and Access Management (IAM), AWS Certificate Manager, AWS Directory Service, AWS Single Sign-On 

  

**Objective Evidence:**   

-   Administrative: documented policies, standards & procedures
-   Administrative: supporting documentation to demonstrate how Identity & Access Management (IAM) practices are implemented
-   Administrative: supporting documentation to demonstrate the "secure practices" used to build technology platform-specific secure baseline configurations
-   Technical: screenshot of configuration settings 

  

Possible Technology Considerations : 

-   Identity & Access Management (IAM)
-   Secure Baseline Configurations (SBC) 

  

**What needs to be answered :**  

Are the accounts in use assigned and managed by the company’s central management system? Are accounts uniquely assigned to new employees, contractors, or subcontractors upon hire? Are initial passwords given to new hires reset upon first use? Are all passwords at least 2 characters with uppercase, lowercase, letters, numbers, and special characters?

-   Authenticate User, Process, and Device Identities  
    Description: This check ensures that organizational systems implement authentication mechanisms to verify the identities of users, processes, and devices before granting access. Authentication methods may include passwords, key cards, cryptographic devices, and one-time password devices. Organizations establish and enforce authentication policies, such as minimum password length and validation time window for one-time tokens, to ensure secure authentication practices. It is important to avoid using default authentication credentials, as they are often easily discoverable and pose a significant security risk. System components should not ship with factory default authentication credentials, and organizations should change the initial authenticator content upon installation. Authenticator management includes issuing and revoking authenticators, as well as managing temporary access for remote maintenance. Device authenticators, such as certificates and passwords, are also considered in the authentication process. 

  

**More Details:**   

Users must authenticate with unique credentials prior to accessing systems containing CUI.

## Related compliance guidance

- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): How the 800-53 catalogue, baselines and the Risk Management Framework fit together, and which controls take the most work in the cloud.
- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): If the driver is a DoD or federal contract handling CUI, 800-171 (and CMMC) is the scope you actually need.