Mapped to NIST 800-171 Requirement: 3.13.10
CMMC Assessment Objective: SC.L2-3.13.10[d]
What This Control Means
It’s not enough to document and use session authenticity protections—you must also enforce them technically, so:
• Users must authenticate securely before gaining access
• Systems must verify each other’s identity before sharing data
• Sessions must be denied if authenticity cannot be verified
No manual workarounds, no “optional” security settings—authentication must be built-in and mandatory.
Why It Matters
Without enforcement:
• Weak or missing session protections could expose CUI
• Users or attackers could impersonate legitimate sessions
• Session hijacking or spoofing attacks could compromise critical systems
• Compliance assessments will fail if protections rely only on user discipline
Enforcement ensures authenticity is a condition—not a choice.
How to Implement It
1. Lock Down System Configurations
• Force TLS, SSL/TLS handshakes, or IPsec for all communications
• Require strong authentication methods (certificates, MFA) on all session establishment
2. Block Non-Secure or Unauthenticated Sessions
• Use firewalls, VPN concentrators, and API gateways to reject:
◦ Unencrypted sessions
◦ Sessions missing proper authentication tokens or certs
◦ Session downgrade attempts (e.g., forcing TLS 1.0)
3. Enforce Policies Through Technical Controls
• Use GPOs, MDMs, endpoint protection, and cloud configuration management to apply and enforce session settings
4. Monitor Session Enforcement
• Log rejected session attempts
• Alert on non-compliant connection efforts
• Include enforcement validation in your regular audits and scans
Evidence the Assessor Will Look For
• Configuration files showing mandatory session authentication enforcement
• Firewall, VPN, or API gateway rules enforcing session authentication
• Logs or alerts showing rejected unauthenticated or downgraded session attempts
• Screenshots showing encryption and authentication requirements on remote access systems
• SIEM reports validating that only authenticated sessions are allowed
Common Gaps
• Session authentication available but not required
• Weak settings allowing fallback to non-secure or unauthenticated sessions
• Remote access portals accessible without MFA or proper certificates
• Inconsistent enforcement across systems or environments
How Cuick Trac Helps
Cuick Trac supports this requirement by:
• Monitoring and logging session authentication enforcement across systems
• Alerting when unauthenticated sessions are attempted or succeed
• Ensuring GPOs, MDM, and firewall policies mandate authentication at all access points
• Providing evidence that enforcement settings are active and effective
• Linking session protection enforcement to your broader SSP and risk management strategy
With Cuick Trac, session authenticity isn’t just enabled—it’s unskippable, enforced, and audit-proof.
Final CTA
Trust every session—because you verify every session.
Schedule a Cuick Trac demo to enforce session authenticity and lock down your communications security.