3.5.1 Identify system users, processes acting on behalf of users, and devices.

Common device identifiers include Media Access Control (MAC), Internet Protocol (IP) addresses, or device-unique token identifiers. Management of individual identifiers is not applicable to shared system accounts. Typically, individual identifiers are the user names associated with the system accounts assigned to those individuals. Organizations may require unique identification of individuals in group accounts or for detailed accountability of individual activity. In addition, this requirement addresses individual identifiers that are not necessarily associated with system accounts. Organizational devices requiring identification may be defined by type, by device, or by a combination of type/device.

[SP 800-63-3] provides guidance on digital identities.

Actionable Items:  This requires documentation of your hardware and users. Users should be identified by not only their personal information but what roles and activities they pursuant to CUI. Devices should be identified by IP Address, MAC Address, Serial Number, Make/Model and Asset Tag if any.