Question 1

What is the Identification and Authentication family in CMMC?

Accepted Answer

Identification and Authentication governs how every user, process, and device proves its identity before reaching your systems. It appears at both CMMC levels: 2 practices at Level 1 (FAR 52.204-21) and 11 practices at Level 2 (NIST SP 800-171 Rev 2). These are two separate counts measured against two different standards.

Question 2

How is Identification and Authentication scored at Level 1 versus Level 2?

Accepted Answer

Level 1 is scored as an overall compliance percentage across the 15 FAR 52.204-21 practices, with no SPRS points. Level 2 uses the SPRS methodology, where each practice carries a point weight of 1, 3, or 5. The two figures are separate and are never combined into one number.

Question 3

Which Identification and Authentication practices cannot be placed on a POA&M?

Accepted Answer

In Identification and Authentication, any practice worth more than 1 point cannot be deferred to a POA&M, per 32 CFR 170.21(a)(2)(ii). Only 1-point gaps are POA&M-eligible, and they must be closed within 180 days of the Conditional Status Date.

Question 4

Does Identification and Authentication have any partial-credit practices?

Accepted Answer

Yes. Identification and Authentication contains IA.L2-3.5.3 (multifactor authentication), one of only two partial-credit practices in the entire methodology. On it, a Partial result deducts 3 points instead of the full 5. The other partial-credit practice sits in a different family. Every other Identification and Authentication practice is scored Met or Not met.