IA.L2-3.5.4
Replay-Resistant Authentication
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee IA.L2-3.5.4 in the reference catalog with its NIST cross-references
Official requirement
Employ replay -resistant authentication mechanisms for network access to privileged and non-privileged accounts.
Assessment objectives
a. replay-resistant authentication mechanisms are implemented for network account access to privileged and non-privileged accounts.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Use authentication mechanisms resistant to replay for network account access.
Implementation example
Example from the source assessment guide (not a mandatory implementation): To protect your IT infrastructure, you understand that the methods for authentication must not be easily copied and re- sent to your systems by an adversary. You select Kerberos for authentication because of its built-in resistance to replay attacks. As a next step you upgrade all of your web applications to require Transport Layer Security (TLS), which also is replay- resistant. Your use of MFA to protect remote access also confers some replay resistance.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Identification and authentication policy; procedures addressing user identification and authentication; system security plan; system design documentation; system configuration settings and associated documentation; system audit logs and records; list of privileged system accounts; other relevant documents or records
Common mistakes
Assuming an encrypted connection alone proves the authentication exchange resists replay.