CMMC v2.0
3.5 IDENTIFICATION AND AUTHENTICATION
IA.L2-3.5.3
Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts
Multifactor authentication requires the use of two or more different factors to authenticate. The factors are defined as something you know (e.g. password personal identification number [PIN]); something you have (e.g. cryptographic identification device token); or something you are (e.g. biometric). Multifactor authentication solutions that feature physical authenticators include hardware authenticators providing time-based or challenge-response authenticators and smart cards. In addition to authenticating users at the system level (i.e. at logon) organizations may also employ authentication mechanisms at the application level when necessary to provide increased information security.Access to organizational systems is defined as local access or network access. Local access is any access to organizational systems by users (or processes acting on behalf of users) where such access is obtained by direct connections without the use of networks. Network access is access to systems by users (or processes acting on behalf of users) where such access is obtained through network connections (i.e. nonlocal accesses). Remote access is a type of network access that involves communication through external networks. The use of encrypted virtual private networks forconnections between organization-controlled and non-organization controlled endpoints may be treated as internal networks with regard to protecting the confidentiality of information [SP 800-63-3] provides guidance on digital identities
Click here to Start your FREE trial today!
What is a Cybersecurity Compliance Framework?
You don’t need to clutter your security and privacy programs with an ever-increasing number of tools as they become more sophisticated. The Lionfish platform offers a one-stop solution to track progress and monitor any framework, from custom-built ones to highly-specialized and in-demand top security and privacy frameworks and certifications.
With the Lionfish platform, every framework is supported with guided scoping, policies, controls, automated evidence collection, and continuous monitoring, ensuring efficient preparation for audits or attestation in minimal time.
The Lionfish platform is compatible with a wide range of security and privacy frameworks, including:
- CMMC v2
- HIPAA
- NERC CIP-002 through CIP-014 Revision 6
- NIST 800-171
- NIST 800-172
- PCI (Payment Card Industry Security Standard)
- SOC 2
- NIST 800-53
- NIST SP800-161 Supply Chain Risk Management
- NIST-CSF
- CIS Framework Controls V8
Click here to Start your FREE trial today!