Mapped to NIST 800-171 Requirement: 3.5.2
CMMC Assessment Objective: IA.L2-3.5.2[c]
What This Objective Means
You’ve identified accounts requiring MFA (IA.L2-3.5.2[a]) and ensured those accounts require it (IA.L2-3.5.2[b]). Now, this objective checks whether the system configurations themselves enforce MFA.
This applies to:
• Identity providers (e.g., Azure AD, Okta, Duo)
• Operating system login settings
• VPNs, remote access portals, and management consoles
• SaaS platforms and cloud environments
• Local authentication methods, if used
The goal is to prove that MFA mechanisms are properly configured, enforced, and operational.
Why It Matters
Without proper implementation:
• MFA policies may appear enabled but not be enforced
• Users might bypass MFA through alternative login paths
• Devices or accounts could be added without MFA enabled
• Auditors won’t accept policies without configuration evidence
System-level implementation turns intent into real-world security.
How to Implement It
1. Configure MFA in All Authentication Points
• Identity platforms (e.g., Duo, Microsoft 365, Okta)
• Remote access solutions (e.g., VPN, Citrix, RDP gateways)
• Endpoint login policies (GPO, local security settings)
2. Use Conditional Access Policies or Rules
• Enforce MFA for specific groups, roles, or device types
• Block legacy authentication protocols that bypass MFA (e.g., POP3, IMAP)
3. Apply to Admin Interfaces and APIs
• Ensure MFA is required for system management portals, cloud consoles, and administrative access
4. Audit Configurations Regularly
• Review configuration settings in dashboards or config files
• Test access flows to confirm MFA prompts appear
5. Disable MFA Bypass Options
• Remove “remember this device” features unless explicitly permitted
• Block fallback authentication that doesn’t require MFA
Evidence the Assessor Will Look For
• MFA configuration settings from identity providers
• Screenshots of policies enforcing MFA for different systems
• Logs showing successful/failed MFA authentication events
• Documentation showing which systems have MFA enabled and how it’s enforced
• Conditional access policy exports or endpoint enforcement GPOs
Common Gaps
• MFA only partially deployed (e.g., VPN only, not endpoint login)
• MFA set to “optional” or bypassable
• Legacy systems or user paths allow non-MFA logins
• No logs or screenshots proving MFA enforcement
How Cuick Trac Helps
Cuick Trac supports this control by:
• Requiring MFA enforcement across all access points within the enclave
• Integrating with leading MFA platforms to ensure consistent configuration
• Blocking access to any system component that isn’t MFA-protected
• Providing system-level enforcement settings and audit-ready documentation
• Regularly validating MFA implementation through policy monitoring and access tests
Cuick Trac ensures that MFA isn’t just turned on—it’s working everywhere it’s needed.
Final CTA
Multifactor authentication doesn’t count unless it’s configured and working.
Schedule a Cuick Trac demo to confirm that your MFA enforcement is real, reliable, and reviewable.