id: "IA-02(01)" title: "Multi-factor Authentication to Privileged Accounts" family: "IA" family_name: "Identification and Authentication" sort_id: "ia-02.01" priority: "P1" implementation_level: "system" parent: "IA-02" enhancement: True
Statement
Implement multi-factor authentication for access to privileged accounts.
Guidance
Multi-factor authentication requires the use of two or more different factors to achieve authentication. The authentication factors are defined as follows: something you know (e.g., a personal identification number [PIN]), something you have (e.g., a physical authenticator such as a cryptographic private key), or something you are (e.g., a biometric). Multi-factor authentication solutions that feature physical authenticators include hardware authenticators that provide time-based or challenge-response outputs and smart cards such as the U.S. Government Personal Identity Verification (PIV) card or the Department of Defense (DoD) Common Access Card (CAC). In addition to authenticating users at the system level (i.e., at logon), organizations may employ authentication mechanisms at the application level, at their discretion, to provide increased security. Regardless of the type of access (i.e., local, network, remote), privileged accounts are authenticated using multi-factor options appropriate for the level of risk. Organizations can add additional security measures, such as additional or more rigorous authentication mechanisms, for specific types of access.
Assessment Objective
multi-factor authentication is implemented for access to privileged accounts.
Identification and authentication policy
procedures addressing user identification and authentication
system security plan
system design documentation
system configuration settings and associated documentation
system audit records
list of system accounts
other relevant documents or records
Organizational personnel with system operations responsibilities
organizational personnel with account management responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
Mechanisms supporting and/or implementing a multi-factor authentication capability