Different actors in information processing environments must be securely identified before being granted access to the information.

Device identification: Only terminal devices provided and managed by the organization, and approved for the relevant classification level, may be used to process classified information. The connection of any other devices to the classified information processing environment is strictly prohibited. Personnel are instructed and required to comply with this rule.

System identification: Information systems that exchange data with each other must be identified using a technique appropriate for the use case, such as passwords, keys (e. g. API key), tokens (e. g. oAuth), or equivalent methods. Authentication must take place over encrypted connections.