NIST 800-171 Controls · Identification & Authentication

IA.1.077 — Authenticate identities of users, processes, and devices

CMMC Level 1SPRS if unmet: -5CRITICAL priority~6h to implement

Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

What IA.1.077 means in plain English

After you know who someone claims to be (identification), you must verify it is really them before letting them in. The most basic form is a password. Every single account on every single system must require a password before access is granted — no auto-login workstations, no Wi-Fi without a password, no systems that just open when you click them. For your small team, this means Windows login passwords are mandatory on every laptop, your router requires a strong admin password, and any cloud service requires a password at login.

The assessment question

“Does every system, application, and device require credential-based authentication before granting access — with no systems accessible without logging in?”

How to implement IA.1.077

Enable Windows password requirement on all workstations via Group Policy or local security policy: require password at logon and on wake from sleep.
Change all default passwords on routers, switches, printers, and NAS devices to strong unique passwords documented in a password manager.
Verify every cloud application (email, file storage, CRM) requires a username and password — disable any "open" or "anonymous" access configurations.
Enable screen-lock after 15 minutes of inactivity on all workstations and mobile devices accessing company data.
Store all administrative credentials in a password manager (Bitwarden Teams) so no password is written on a sticky note or stored in plain text.

Evidence your assessor will ask for

Group Policy Object (GPO) export or screenshot showing password requirement enforced
Screenshot of screen-lock policy applied to all workstations
Password manager subscription showing all team members enrolled
Evidence that default passwords have been changed on all network devices (configuration screenshots)

Does AI prompt monitoring help with this control? Honestly, no.

IA.1.077 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More Identification & Authentication controls

IA.1.076

Identify system users, processes, and devices

IA.2.078

Use multifactor authentication for local and network access

IA.2.079

Employ replay-resistant authentication mechanisms

IA.2.080

Prevent reuse of identifiers

IA.2.081

Disable identifiers after defined period of inactivity

IA.2.082

Enforce minimum password complexity and change of characters

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment