What this control covers
This control requires the unique identification and authentication of specified devices before establishing a system connection. Device identification can include methods like MAC addresses or TCP/IP addresses, while authentication may involve organizational solutions such as IEEE 802.1x, EAP, RADIUS, Kerberos, or PKI-based certificates. This control supports the Device Authentication Management capability within the Identification and Authentication (3.5) family.
Why it matters
Endpoint posture (encryption, EDR, OS patch state) is also the most common evidence customers ask for in their vendor reviews.
How to implement
AWS
Bake hardening into EC2 Image Builder + AMI accounts; use Systems Manager Fleet Manager for inventory and patch state.
Azure
Intune enrolment for laptops + phones; Conditional Access requires "compliant device" before any corporate app loads. EDR via Defender for Endpoint.
GCP
Use Cloud Identity (or Workspace) as the IdP and IAM for resource access. Grant roles at the lowest scope (project > folder > org) using Workload Identity Federation for CI/CD and service accounts for workloads — never download service-account keys when avoidable. Enable Policy Intelligence recommenders to right-size privileges and detect dormant identities.
Google Workspace
Endpoint Management (basic/advanced) for BYOD/COPE; require screen lock, disk encryption and OS minimum; block sign-in on jailbroken devices.
GitHub
Require SSO + SCIM from your IdP on the organisation; enforce 2FA org-wide and use fine-grained PATs (or, better, GitHub Apps) instead of classic tokens. Restrict outside collaborators, require signed commits on protected branches, and use OIDC from Actions to short-lived AWS/GCP/Azure credentials rather than stored secrets.
Zoho Mail
Make two-factor authentication mandatory for all users (TOTP, OneAuth, or YubiKey) in Admin Console → Security. Configure SAML SSO against your IdP and disable password-based logins for admins. Use role-based privileges (Admin / Spam Moderator / Mail Account Admin) and review the Login history report monthly for anomalies.
Evidence to collect
user_device_scan— Output from your MDM/EDR (Intune, Jamf, Kandji) showing managed-device count, posture and last-check-in.
Endpoint compliance telemetry (Intune, Jamf) proves managed coverage. Focus: Device Identification and Authentication.
Quick checklist
- Device — Management / Methods Like Mac Addresses
- Protection — Management / Methods Like Mac Addresses
- System — Management / Methods Like Mac Addresses
- Authentication — Management / Methods Like Mac Addresses
- Security — Management / Methods Like Mac Addresses
Related articles on this site
- NIST 800-171 3.1.18 Control connection of mobile devices.
- NIST 800-171 3.13.7 Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).
- CMMC 2.0 AC.3.020 Control connection of mobile devices.
- CMMC 2.0 SC.3.184 Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).