6.2 Identification & Authentication (IA) Domain: MFA & Credential Management

Identification & Authentication: Identity Proof, MFA & Authenticators

Identification answers which identity is requesting access; authentication establishes that the claimant controls the associated authenticator. NIST SP 800-171 Revision 2 contains 11 IA requirements. Requirements 3.5.1 and 3.5.2 also map to Level 1; all 11 apply at Level 2.

Identify and authenticate

Requirement 3.5.1 identifies system users, processes acting for users, and devices. 3.5.2 authenticates or verifies those identities before allowing access. Evidence may include account and device records, identity-provider configuration, certificates, service-account design, join processes, and representative tests.

A display name is not necessarily a unique identity. Shared credentials, cloned device identities, dormant accounts, and service accounts without owners can undermine both requirements. The team traces the approved person, process, or device to the identifier and authenticator actually used.

Exact MFA coverage

Requirement 3.5.3 requires multifactor authentication for:

• local access to privileged accounts;
• network access to privileged accounts; and
• network access to nonprivileged accounts.

It does not require MFA for local access to every nonprivileged account under this requirement. Other policies or contracts may do so, but the assessor should not attribute that broader rule to 3.5.3.

MFA uses at least two different factor types: something known, something possessed, or a biometric characteristic. A password plus a second PIN is two secrets but one factor type. The team must also evaluate the actual access path. MFA on a VPN does not automatically establish that a bypass path, local administrator login, legacy protocol, or service interface enforces the same control.

Replay resistance and identifier lifecycle

Requirement 3.5.4 uses replay-resistant authentication mechanisms for network access to privileged and nonprivileged accounts. Challenge-response protocols, one-time values, and properly configured cryptographic protocols can provide replay resistance. Merely encrypting a static password database does not show that a captured network authentication exchange cannot be replayed.

Requirement 3.5.5 prevents reuse of identifiers for an organization-defined period, and 3.5.6 disables identifiers after an organization-defined period of inactivity. The organization selects defensible values and must show the configured lifecycle. These requirements concern identifiers, not only passwords.

Password requirements without folklore

Requirement 3.5.7 enforces a minimum password complexity and change of characters when new passwords are created. It does not specify a universal 60- or 90-day expiration period. An organization may impose one through its own policy or another authority, but a CMMC finding must use the actual objective and organization-defined parameters.

Requirement 3.5.8 prohibits password reuse for a specified number of generations. 3.5.9 permits a temporary password only with an immediate change to a permanent password. 3.5.10 stores and transmits only cryptographically protected passwords, and 3.5.11 obscures authentication feedback so observers cannot learn the secret.

Salted password hashing, protected channels, hardware-backed authenticators, and vaults are common implementations. The requirement does not name one algorithm for every system. The assessment examines the deployed protection, configuration, and relevant cryptographic validation instead of assuming that a product default is adequate.

Evidence patterns

For MFA, examine the identity architecture and policy, then inspect the enabled methods, conditional rules, exceptions, local account settings, and enrollment records. Interview identity administrators and sampled users. Test representative privileged local access, privileged network access, and nonprivileged network access when appropriate.

For lifecycle requirements, compare HR or sponsor records with identity-provider status, inactivity settings, identifier reuse controls, temporary-password workflows, and recent samples. For service accounts, determine whether interactive login is permitted, who owns the account, how authentication works, and whether exceptions are authorized and supported by the objectives.

Do not mark an objective MET based only on screenshots selected by the OSC if they omit the affected population. Focused sampling must represent the technologies, locations, identity stores, and account types in scope.

Scenario method

A user connects remotely with a password, then opens an administrative console that prompts for a second password. That does not necessarily establish MFA: both prompts may use the knowledge factor. Conversely, a smart card protected by a PIN can combine possession and knowledge when implemented as designed. Identify the factor types and verifier behavior rather than counting prompts.

An organization that forces password changes every 90 days may satisfy its own policy, but that setting is not the published text of 3.5.7. A better exam answer distinguishes the minimum-complexity and changed-character objective from organization-specific expiration policy.