Navigate

CCI-004048

CCI-004048 Definition

Defines the strength of mechanism requirements for implementing multi-factor authentication.

Status
Type	CheckType.technical

Master Assessment Datasheet

Implementation Guidance

Determine if multi-factor authentication is implemented for [IA-02(06)_ODP[01]; one or more of the following PARAMETER VALUES is/are selected: {local; network; remote}] access to [IA-02(06)_ODP[02]; one or more of the following PARAMETER VALUES is/are selected: {privileged accounts; non-privileged accounts}] such that the device meets [IA-02(06)_ODP[03]; the strength of mechanism requirements to be enforced by a device separate from the system gaining access to accounts is defined].

Validation Procedures

Examine: [SELECT FROM: Identification and authentication policy; system security plan; procedures addressing user identification and authentication; system design documentation; system configuration settings and associated documentation; system audit records; list of system accounts; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with system operations responsibilities; organizational personnel with account management responsibilities; organizational personnel with information security responsibilities; system/network administrators; system developers]. Test: [SELECT FROM: Mechanisms supporting and/or implementing multi-factor authentication capability].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-004048.

Control	Description
IA-2(6)	Implement multi-factor authentication for [one or more of "local"/"network"/"remote"] access to [one or more of "privileged accounts"/"non-privileged accounts"] such that: (a): One of the factors is provided by a device separate from the system gaining access; and (b): The device meets [the strength of mechanism requirements to be enforced by a device separate from the system gaining access to accounts is defined;].

Control

Description

IA-2(6)

Implement multi-factor authentication for [one or more of "local"/"network"/"remote"] access to [one or more of "privileged accounts"/"non-privileged accounts"] such that:

(a): One of the factors is provided by a device separate from the system gaining access; and

(b): The device meets [the strength of mechanism requirements to be enforced by a device separate from the system gaining access to accounts is defined;].