What this requirement asks
Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.
This is a CMMC Level 2 requirement in the Identification & Authentication family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (1)
- 3.5.4[a] — replay-resistant authentication mechanisms are implemented for network account access to privileged and non-privileged accounts
What an assessor examines
Examine:
- Identification and authentication policy
- procedures addressing user identification and authentication
- system security plan
- system design documentation
- system configuration settings and associated documentation
- system audit logs and records
- list of privileged system accounts
- other relevant documents or records
Interview:
- Personnel with system operations responsibilities
- personnel with account management responsibilities
- personnel with information security responsibilities
- system or network administrators
- system developers
Test:
- Mechanisms supporting or implementing identification and authentication capability or replay resistant authentication mechanisms
Evidence that defends it
Demonstrate MFA requirement on remote entry
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.