IA.1.076 — Identify system users, processes, and devices

What IA.1.076 means in plain English

Every person, computer program, and device that touches your system must have a unique identity — no shared accounts, no anonymous logins. Think of it like a sign-in sheet at your office front door: you need to know exactly who (or what) came in. For your 8-person shop, this means every employee has their own Windows login, every service account has a name, and every printer or networked device is registered. If someone leaves, you know exactly which account to disable.

The assessment question

“Does every user, automated process, and networked device have a unique, individually assigned identifier — with no shared or generic accounts in active use?”

How to implement IA.1.076

1. Audit all user accounts in Active Directory or Azure AD and confirm each maps to one specific, named individual.
2. Delete or disable all shared, guest, or named-after-roles accounts (e.g., "admin", "front-desk") and create personal accounts for each user.
3. Inventory every networked device (printers, NAS drives, IoT devices) and assign each a documented hostname and service account where applicable.
4. Document all automated service accounts (backup jobs, monitoring agents) with an owner assigned and a purpose recorded.
5. Set a quarterly review calendar reminder to audit account lists and remove any stale identities.

Evidence your assessor will ask for

• Screenshot of full user account list showing no shared or generic accounts
• Device inventory spreadsheet mapping each device to an owner or service account
• Service account register with owner names and business purpose
• Signed Acceptable Use Policy referencing individual account responsibility

More Identification & Authentication controls