Mapped to NIST 800-171 Requirement: 3.5.10
CMMC Assessment Objective: IA.L2-3.5.8[b]
What This Objective Means
You’ve already documented which authentication mechanisms are in use—now it’s time to prove they’re implemented.
This includes:
• Verifying systems use the correct authentication method (e.g., passwords + MFA, PKI, tokens)
• Confirming enforcement through configuration
• Ensuring deprecated or insecure methods (e.g., basic auth) are disabled
• Confirming machine-to-machine authentication is functioning (e.g., certificates, key-based access)
The implementation must match your policies and SSP.
Why It Matters
Without technical implementation:
• Users could bypass secure authentication (e.g., login without MFA)
• APIs or services might use hardcoded or unrotated tokens
• Weak, legacy authentication could expose CUI
• Your documentation won’t reflect actual system behavior
Authentication controls only matter if they’re enforced at the system level.
How to Implement It
1. Review Configurations by System Type
• Operating Systems: Ensure domain authentication, MFA, or local password policies are active
• Cloud Services: Confirm MFA and secure login flows are required
• APIs/Automation: Verify that tokens, certificates, or SSH keys are enforced
2. Confirm Enforcement
• Test login processes and ensure users cannot bypass required authentication methods
• Attempt authentication using disabled or legacy protocols to confirm rejection
3. Use Centralized Identity Providers Where Possible
• Enforce SSO or federated login with MFA across web-based systems
• Apply conditional access policies
4. Audit Regularly
• Use scripts or IAM tools to identify systems not enforcing proper authentication
Evidence the Assessor Will Look For
• Screenshots of authentication settings in system configurations
• Exports or policies from identity providers (e.g., Azure AD, Okta)
• Logs showing successful and failed authentications using expected mechanisms
• Live demonstrations of authentication mechanisms in action
• Documentation showing configuration matches defined policy
Common Gaps
• MFA configured but not enforced on login
• Legacy systems use outdated authentication (e.g., basic auth, NTLMv1)
• APIs with long-lived or static tokens not rotated or restricted
• Authentication mechanisms are described in policy but not reflected in live systems
How Cuick Trac Helps
Cuick Trac supports this control by:
• Enforcing secure authentication mechanisms across all enclave systems
• Blocking access unless the proper method (MFA, certificate, key) is presented
• Integrating with centralized identity providers for uniform enforcement
• Logging all authentication attempts for auditability
• Helping customers verify that policy matches practice at the system level
With Cuick Trac, implementation is guaranteed—not assumed.
Final CTA
Secure authentication isn’t just something you document—it’s something you do.
Schedule a Cuick Trac demo to ensure your authentication controls are configured, tested, and enforced everywhere.