- Set and write down the reuse-prohibition period; most organizations simply never reuse identifiers, which satisfies the intent trivially and keeps forensics clean.
- Watch email aliases and display names as well as logins — reuse there causes the same attribution confusion.
3.5.5OFFICIAL STATEMENT BELOWDERIVED REQUIREMENTPENDING NIST SME REVIEW
3.5.5 — Identifier reuse prevention
3.5 Identification and Authentication · NIST SP 800-171 Rev. 2 · The heading label is this site's navigational shorthand; the official language is the statement below.
Official requirement statement (verbatim)
Prevent reuse of identifiers for a defined period.
NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems ↗NIST SP 800-171A — Assessing Security Requirements for CUI ↗Independent interpretation
What this requirement is after
When someone leaves, their username must not be handed to the next hire while logs, file ownership, and mailbox trails still point at the old identity. Identifiers are retired and quarantined for a defined period before any reuse.
Across revisions
Folded into Rev. 3's consolidated Identifier Management requirement, 03.05.05.
Mapped practices
Brilliant at the Basics practices that support this requirement
No practice maps to this requirement — deliberately.
The campaign’s twenty practices are a priority list, not a control catalog, and none of them works this requirement’s substance directly. It still applies to you if it is in your contract’s scope: address it through your own implementation and the related artifacts below, and treat the absence of a mapping here as honesty, not permission to skip it.
Doing the work
Implementation considerations and evidence
- The written identifier-management rule naming the defined period
- Directory records showing departed identifiers disabled and retained rather than recycled
Artifacts
Templates and worksheets with a mapped relationship
No artifact in the library names this requirement yet. The library index groups everything by category and practice.
The other revision
Where this lands in Rev. 3
Provenance
Sources and review status
| Primary sources | NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems · NIST SP 800-171A — Assessing Security Requirements for CUI |
|---|---|
| Review status | Pending NIST SME review |
| Content version | 1.0 |
| Updated |