# NIST800 171 3.5.2 — Device Identification and Authentication

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_nist800171_352_6d90eda12d-nist800-171-352-device-identification-and-authentication
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST SP 800-171 Readiness](https://support.icompaas.com/support/solutions/c_gen_nist800171) › [Identification and Authentication](https://support.icompaas.com/support/solutions/folders/f_gen_cgennist800171_identificationandauthentication)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

NIST800 171 · Control 3.5.2 · Priority: high · Component: Identification and Authentication

### What this control covers

This control requires the unique identification and authentication of specified devices before establishing a system connection. Device identification can include methods like MAC addresses or TCP/IP addresses, while authentication may involve organizational solutions such as IEEE 802.1x, EAP, RADIUS, Kerberos, or PKI-based certificates. This control supports the Device Authentication Management capability within the Identification and Authentication (3.5) family.

### Why it matters

Endpoint posture (encryption, EDR, OS patch state) is also the most common evidence customers ask for in their vendor reviews.

### How to implement

#### AWS

Bake hardening into **EC2 Image Builder** + **AMI accounts**; use **Systems Manager Fleet Manager** for inventory and patch state.

#### Azure

**Intune** enrolment for laptops + phones; Conditional Access requires "compliant device" before any corporate app loads. EDR via **Defender for Endpoint**.

#### GCP

Use **Cloud Identity** (or Workspace) as the IdP and **IAM** for resource access. Grant roles at the lowest scope (project > folder > org) using **Workload Identity Federation** for CI/CD and **service accounts** for workloads — never download service-account keys when avoidable. Enable **Policy Intelligence** recommenders to right-size privileges and detect dormant identities.

#### Google Workspace

**Endpoint Management** (basic/advanced) for BYOD/COPE; require screen lock, disk encryption and OS minimum; block sign-in on jailbroken devices.

#### GitHub

Require **SSO + SCIM** from your IdP on the organisation; enforce **2FA** org-wide and use **fine-grained PATs** (or, better, GitHub Apps) instead of classic tokens. Restrict **outside collaborators**, require signed commits on protected branches, and use **OIDC** from Actions to short-lived AWS/GCP/Azure credentials rather than stored secrets.

#### Zoho Mail

Make **two-factor authentication** mandatory for all users (TOTP, OneAuth, or YubiKey) in _Admin Console → Security_. Configure **SAML SSO** against your IdP and disable password-based logins for admins. Use **role-based privileges** (Admin / Spam Moderator / Mail Account Admin) and review the _Login history_ report monthly for anomalies.

### Evidence to collect

-   `user_device_scan` — Output from your MDM/EDR (Intune, Jamf, Kandji) showing managed-device count, posture and last-check-in.

Endpoint compliance telemetry (Intune, Jamf) proves managed coverage. Focus: Device Identification and Authentication.

### Quick checklist

-   Device — Management / Methods Like Mac Addresses
-   Protection — Management / Methods Like Mac Addresses
-   System — Management / Methods Like Mac Addresses
-   Authentication — Management / Methods Like Mac Addresses
-   Security — Management / Methods Like Mac Addresses

### Related articles on this site

-   [NIST 800-171 3.1.18 Control connection of mobile devices.](https://support.icompaas.com/support/solutions/articles/62000229255-nist-800-171-3-1-18-control-connection-of-mobile-devices-)
-   [NIST 800-171 3.13.7 Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).](https://support.icompaas.com/support/solutions/articles/62000229259-nist-800-171-3-13-7-prevent-remote-devices-from-simultaneously-establishing-non-remote-connections-wi)
-   [CMMC 2.0 AC.3.020 Control connection of mobile devices.](https://support.icompaas.com/support/solutions/articles/62000229419-cmmc-2-0-ac-3-020-control-connection-of-mobile-devices-)
-   [CMMC 2.0 SC.3.184 Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).](https://support.icompaas.com/support/solutions/articles/62000229745-cmmc-2-0-sc-3-184-prevent-remote-devices-from-simultaneously-establishing-non-remote-connections-with)

## Related compliance guidance

- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): The CUI requirements CMMC Level 2 assesses, the SPRS score, POA&M rules and the phased DFARS rollout.
- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): The federal catalogue 800-171 is derived from — useful when a contract also cites a FedRAMP baseline.