IA.L2-3.5.2[b] – Examine system accounts to ensure multifactor authentication is required for access.

This objective ensures that MFA is not only identified as a requirement (from IA.L2-3.5.2[a]), but also actively enforced for the applicable accounts. It confirms that users must present two or more authentication factors before being granted access to systems, especially those that process or store Controlled Unclassified Information (CUI).

IA.L2-3.5.1[b] – Examine system accounts to ensure passwords are required for authenticating to systems.

This objective ensures that all system accounts identified as password-based (in IA.L2-3.5.1[a]) are actually configured to require a password when accessing systems that store, process, or transmit Controlled Unclassified Information (CUI). It validates that password authentication is technically enforced.

IA.L2-3.5.7[d] – Determine if system use notifications are implemented.

This objective confirms that system use notifications—defined, displayed, and acknowledged per the earlier objectives—are fully implemented across the organization’s systems. It ties together all previous steps to validate that system use notices are not only configured, but actually operational and enforced in practice.

IA.L2-3.5.8[b] – Examine system configurations to ensure authentication mechanisms are implemented.

This objective ensures that the authentication mechanisms identified in IA.L2-3.5.8[a] are actually deployed and functioning across systems, particularly those that handle Controlled Unclassified Information (CUI). It confirms that each authentication method is technically configured and enforced where required.

IA.L2-3.5.9 – Prevent the reuse of identifiers for a defined period.

This control requires your organization to restrict the reuse of user identifiers (such as usernames, user IDs, or account names) within a defined timeframe after they have been deactivated or deleted. This helps prevent confusion, improper access inheritance, or potential misattribution of activity to the wrong individual.

IA.L2-3.5.2[c] – Examine system configurations to ensure multifactor authentication is implemented.

This objective confirms that MFA has been technically implemented and configured across the systems where it is required—especially those handling Controlled Unclassified Information (CUI). The focus is on verifying that the MFA mechanisms are not only enabled but are functioning correctly and consistently across environments.

IA.L2-3.5.11 – Uniquely identify and authenticate organizational users.

This control requires your organization to ensure that every user is uniquely identified and authenticated before being granted access to systems that store, process, or transmit Controlled Unclassified Information (CUI). This applies to both human users and system/service accounts and emphasizes accountability and traceability.

IA.L2-3.5.1[c] – Examine system configurations to ensure passwords are protected.

This objective ensures that once passwords are required and in use, your systems are also configured to protect them—during storage and use. This includes enforcing secure handling, encryption, and preventing unauthorized access or exposure of password data.

IA.L2-3.5.4 – Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.

This control requires the use of multifactor authentication (MFA) for two key categories: All local and network access to privileged accounts Network access to non-privileged accounts The goal is to ensure that any account accessing systems—especially those containing Controlled Unclassified Information (CUI)—is protected by strong, layered authentication based on the type and method of access.

IA.L2-3.5.3[d] – Determine if the replay-resistant authentication mechanisms are implemented.

This objective confirms that the replay-resistant authentication controls have been fully implemented across applicable systems and account types, as identified and configured in earlier steps. It moves beyond documentation and configuration to verify that those mechanisms are functioning in practice.