NIST 800-171 Control 3.5.3: Multi-Factor Authentication
Multi-factor authentication (MFA) is a critical safeguard against unauthorized access to your most sensitive systems. Control 3.5.3 requires MFA for all privileged account access and network access to non-privileged accounts, creating multiple verification barriers that significantly reduce breach risk. Understanding and implementing this control properly is essential for NIST 800-171 compliance.
What this means
This control mandates the use of at least two different authentication factors when accessing critical accounts and systems. For privileged accounts (administrators, system owners), MFA must be enforced for both local and network access. For non-privileged accounts, MFA is required at minimum for network access. Acceptable factors include something you know (password), something you have (hardware token, phone), or something you are (biometric). The goal is to ensure that compromising a single credential doesn't grant unauthorized system access.
How to comply
- 1.Identify all privileged accounts (admin, root, service accounts) and non-privileged accounts with network access capability
- 2.Select and deploy an MFA solution that supports your authentication infrastructure (TOTP, push notifications, hardware tokens, or biometrics)
- 3.Configure MFA enforcement policies for all identified accounts with appropriate timeout and re-authentication intervals
- 4.Implement MFA for local access to privileged accounts through mechanisms like physical tokens or biometric authentication
- 5.Enforce MFA for network access to both privileged and non-privileged accounts at the point of entry (VPN, RDP, SSH, directory services)
- 6.Establish and maintain a secure process for managing MFA credentials, including backup authentication methods and recovery procedures
- 7.Document MFA configuration, authorized authentication factors, and account-to-MFA mappings
- 8.Conduct periodic reviews of MFA deployment to ensure coverage and identify orphaned or inactive accounts
Evidence auditors look for
- MFA configuration screenshots showing enforcement policies for privileged and non-privileged accounts
- Access logs demonstrating successful multi-factor authentication events for system logins
- Hardware token inventory or TOTP enrollment records linked to specific user accounts
- VPN and remote access gateway configurations requiring MFA authentication
- Active Directory or identity provider settings enforcing conditional access with MFA
- MFA solution administrator reports showing account coverage and authentication method distribution
- Disaster recovery documentation detailing backup authentication factor procedures
- Audit reports from your MFA platform showing failed authentication attempts and successful MFA verifications
Frequently asked questions
When will FAQs be available?
The FAQ for this control is currently being prepared.
GRCWatch automatically discovers all user accounts across your infrastructure, identifies which ones require MFA under 3.5.3, tracks enforcement status in real-time, and generates compliance reports showing your MFA coverage—eliminating manual account audits and providing auditors instant proof of enforcement.
See how GRCWatch handles this control automatically
Start free trial