IA.L2-3.5.3
Multifactor Authentication
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee IA.L2-3.5.3 in the reference catalog with its NIST cross-references
Official requirement
Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.
Assessment objectives
a. privileged accounts are identified;
b. multifactor authentication is implemented for local access to privileged accounts;
c. multifactor authentication is implemented for network access to privileged accounts; and
d. multifactor authentication is implemented for network access to non-privileged accounts.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Use multifactor authentication for the account types and access paths specified by the requirement.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You decide to implement multifactor authentication (MFA) to improve security of your network. Your first step is enabling MFA on VPN access to your internal network [c,d]. When users initiate remote access, they will be prompted for the additional authentication factor. Because you also use a cloud -based email solution, you require MFA for access to that resource as well [c,d]. Finally, you enable MFA for both local and network logins for the system administrator accounts used to patch and manage servers [a,b,c].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Identification and authentication policy; procedu res addressing user identification and authentication; system security plan; system design documentation; system configuration settings and associated documentation; system audit logs and records; list of system accounts; other relevant documents or records
Common mistakes
Enabling MFA on a remote portal while omitting other required privileged or network access.