Mapped to NIST 800-171 Requirement: 3.5.2
CMMC Assessment Objective: IA.L2-3.5.2[b]
What This Objective Means
This objective confirms that MFA is required and technically enforced for:
• Remote users
• Privileged accounts (admin/root)
• Users accessing systems that handle CUI
• Cloud or SaaS administrative interfaces
Enforcement means the system won’t allow login without a valid second factor—such as a mobile authenticator app, hardware token, or biometric verification.
Why It Matters
If MFA is only recommended—or inconsistently enforced:
• A single stolen password could give attackers full access
• Privileged accounts could be compromised remotely
• You risk non-compliance and audit failure
• Ransomware and data breaches become significantly more likely
Password-only access isn’t enough. Enforcing MFA adds a critical security layer.
How to Implement It
1. Configure MFA in Authentication Systems
• Enable MFA in your identity provider (e.g., Azure AD, Okta, Duo)
• Enforce policy-based MFA for applicable roles or access types
2. Set Up MFA for Local and Remote Logins
• Require MFA for:
◦ VPN or RDP access
◦ Web-based management consoles
◦ SSH sessions (e.g., Duo Unix PAM module)
3. Enforce MFA at the System Level
• Use Group Policy, Conditional Access Policies, or endpoint settings to block access without MFA
4. Monitor Enrollment and Usage
• Track who has enrolled and when
• Generate alerts for users not enrolled or bypassing MFA
5. Test MFA Enforcement
• Attempt access using invalid or incomplete authentication
• Confirm system blocks login without a valid second factor
Evidence the Assessor Will Look For
• MFA enforcement settings (screenshots, policy exports)
• Logs showing MFA challenge events or failures
• Lists of users with MFA enabled
• Documentation of MFA policies and procedures
Common Gaps
• MFA available but not required
• Admins exempt from MFA
• MFA only enforced for remote users, not internal access to CUI
• No logs showing MFA is in use or functioning correctly
How Cuick Trac Helps
Cuick Trac supports this control by:
• Requiring MFA for all privileged and remote access by default
• Integrating with modern MFA providers for seamless enforcement
• Blocking access to secure enclave systems until valid MFA is presented
• Maintaining logs and audit trails to prove enforcement during assessments
• Helping organizations align MFA use with user roles and compliance policies
With Cuick Trac, you’re not hoping MFA is enabled—you’re proving it is.
Final CTA
Knowing MFA is needed isn’t enough. It has to work—every time.
Schedule a Cuick Trac demo to see how we help enforce MFA where it counts.