CMMC Level 2

CMMC Level 2 Identification & Authentication Policy Template

Covers all 11 IA practices (3.5.1-3.5.11): MFA for privileged and standard accounts, password complexity, identifier management, replay-resistant authentication, and cryptographic password storage.

Buy Now - $37 Browse All Templates

✓ Instant download

✓ Editable .docx

✓ 30-day money-back guarantee

✓ Written by CISSP & CCSP

What You Get

What's Inside

Everything is included - no hidden extras, no consulting required.

✓All 11 IA practices (3.5.1-3.5.11) addressed with practice-level policy language
✓MFA requirements for privileged accounts (FIDO2, TOTP, hardware tokens)
✓MFA requirements for standard/non-privileged network access
✓Password complexity rules - minimum 12 characters or 4-word passphrases
✓Cryptographic password storage requirements (bcrypt/PBKDF2, no plaintext)
✓Replay-resistant authentication requirements
✓Identifier management - account creation, reuse prohibition, inactive account controls
✓Session obscurement and feedback requirements (3.5.11)

Ideal For

Who This Is For

Whether you're building from scratch or formalizing what's already in place.

Defense Contractors

Documenting the IA domain - the most commonly failed area in CMMC Level 2 assessments

IT Administrators

Formalizing MFA and password requirements that may already be in place but not documented

MSPs

Providing DoD clients with IA domain documentation written the way C3PAO assessors expect

Ready to Get Compliant?

$37

One-time purchase · Instant download · Editable .docx

Get the Template - $37

30-day money-back guarantee. If it doesn't work for you, get a full refund - no questions asked.

Common Questions

Frequently Asked Questions

Everything you need to know before you buy.

Why is the IA domain the most commonly failed in CMMC assessments?

Most organizations have MFA partially deployed but not fully documented or enforced. Practice 3.5.3 (MFA for privileged accounts) and 3.5.7 (password complexity) are cited most often in assessment findings.

Does this cover MFA for both privileged and non-privileged accounts?

Yes. The policy covers 3.5.3 (MFA for privileged accounts and non-privileged network access) with specific authenticator type requirements.

What authenticator types are covered?

The policy specifies FIDO2 hardware security keys, TOTP authenticator apps, and other approved MFA methods, with guidance on which are appropriate for privileged vs. standard access.

What file format does it come in?

Editable Microsoft Word (.docx). Compatible with Google Docs and LibreOffice.

Stop Starting From a Blank Page