2-6 Identification and Authentication Identification and authentication guidelines are as follows: Identify system users, processes acting on behalf of users, and devices. Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational systems. Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts. Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts. Prevent reuse of identifiers for a defined period. Disable identifiers after a defined period of inactivity. Enforce a minimum password complexity and change of characters when passwords are created. Prohibit password reuse for a specified number of generations. Allow temporary password use for system logons with an immediate change to a permanent password. Store and transmit only cryptographically protected passwords. Obscure feedback of authentication information.