MFA Solutions for CMMC Compliance

Multi-factor authentication is one of the most important security controls for CMMC compliance. Level 2 explicitly requires MFA for network access and privileged accounts, making it a non-negotiable part of your compliance program.

MFA stands for Multi-Factor Authentication—requiring two or more verification methods to prove your identity before granting access.

The good news is that MFA solutions are widely available and increasingly affordable. This guide helps you choose the right MFA approach for your organization and implement it correctly.

Understanding CMMC MFA Requirements

CMMC Level 2 includes specific MFA requirements under the Identification and Authentication control family:

IA.L2-3.5.3: Multi-Factor Authentication

This requirement mandates MFA for:

• Network access to privileged accounts
• Network access to non-privileged accounts
• Local access to privileged accounts

In practical terms, this means everyone accessing systems containing Controlled Unclassified Information (CUI) needs MFA—not just administrators.

CUI stands for Controlled Unclassified Information—sensitive government data requiring protection but not classified as secret.

What Counts as Multi-Factor

Authentication factors fall into three categories:

1. Something you know – Passwords, PINs, security questions
2. Something you have – Phone, hardware token, smart card
3. Something you are – Fingerprint, face recognition, retina scan

MFA requires at least two factors from different categories. A password plus a PIN does not count because both are “something you know.” A password plus a code from your phone does count because you are combining “something you know” with “something you have.”

Replay-Resistant Requirement

CMMC also requires replay-resistant authentication (IA.L2-3.5.4). This means your MFA must use one-time codes or challenge-response mechanisms that cannot be captured and reused by attackers.

This rules out:

• Static PINs are used as a second factor
• Security questions as a second factor
• Any reusable credential

MFA Options for CMMC

Several MFA approaches satisfy CMMC requirements:

Authenticator Apps

Mobile apps that generate time-based one-time passwords (TOTP):

How they work: The app generates a new six-digit code every 30 seconds. You enter your password plus the current code to log in.

Popular options:

• Microsoft Authenticator
• Google Authenticator
• Duo Mobile
• Authy

Pros:

• Free apps
• Works offline
• Easy to deploy
• Meets CMMC requirements

Cons:

• Requires smartphone
• Phone loss creates access issues
• User must install and configure the app

Push Notifications

Apps that send approve/deny prompts to your phone:

How they work: When you log in, your phone displays a notification asking you to approve or deny the access attempt. One tap completes authentication.

Popular options:

• Microsoft Authenticator (push mode)
• Duo Push
• Okta Verify

Pros:

• Very easy for users
• Faster than typing codes
• Shows login context (location, application)

Cons:

• Requires an internet connection on the phone
• Susceptible to “MFA fatigue” attacks if users approve without thinking
• Requires smartphone

Hardware Tokens

Physical devices that generate codes or provide cryptographic authentication:

How they work: You carry a small device that either displays codes or plugs into your computer via USB.

Popular options:

• YubiKey (USB/NFC security key)
• RSA SecurID tokens
• Feitian security keys
• Google Titan keys

Pros:

• Works without a smartphone
• Phishing-resistant (especially FIDO2 keys)
• Very secure
• No battery concerns for USB keys

Cons:

• Hardware cost ($20-$60 per key)
• Can be lost or forgotten
• Some users find them inconvenient

FIDO2 stands for Fast Identity Online 2—an authentication standard using cryptographic keys that provides strong phishing resistance.

Smart Cards and PIV

Government-style smart card authentication:

How they work: Users carry a smart card containing their digital certificate. They insert the card into a reader and enter a PIN to authenticate.

PIV stands for Personal Identity Verification—the federal smart card standard used for government employee authentication.

Pros:

• Extremely secure
• Familiar to government workers
• Provides digital signature capability

Cons:

• Requires card readers on all systems
• Higher implementation complexity
• Card management overhead

SMS and Voice Calls

Codes sent via text message or phone call:

How they work: The system sends a code to your phone number via text or automated call. You enter the code to complete authentication.

Pros:

• Works with any phone
• No app installation required
• Familiar to users

Cons:

• Vulnerable to SIM swapping attacks
• Not recommended by NIST
• May not satisfy stricter interpretations of CMMC requirements

Important: While SMS MFA is better than no MFA, many security professionals and assessors prefer stronger methods. Consider SMS only as a backup or for non-sensitive accounts.

Choosing the Right MFA Solution

For Small Businesses (Under 50 Users)

Best approach: Use MFA included with your existing identity provider.

If you use Microsoft 365 GCC or GCC High, Microsoft Entra ID (formerly Azure AD) includes MFA at no additional cost with Business Premium or higher licenses. Microsoft Authenticator app works well for most users.

If you use Google Workspace, Google’s built-in MFA works similarly.

Budget MFA stack:

• Microsoft Authenticator or Google Authenticator (free)
• A few YubiKeys for administrators ($50 each)
• Total cost: Under $500

For Medium Businesses (50-200 Users)

Best approach: Consider a dedicated MFA platform for more control and reporting.

Recommended solutions:

• Duo Security – Easy to deploy, strong reporting, good documentation
• Okta – Comprehensive identity platform with excellent MFA
• Microsoft Entra ID P1/P2 – Advanced features for Microsoft environments

Budget MFA stack:

• Duo or similar: $3-6 per user per month
• Hardware tokens for privileged users: $50 each
• Total cost: $200-$1,500 per month

For Organizations with Remote Workers

Remote access requires special attention:

• VPN access must require MFA
• Remote desktop must require MFA
• Cloud application access must require MFA

Ensure your MFA solution integrates with your VPN and remote access tools. Most modern solutions support RADIUS or SAML integration for VPN authentication.

RADIUS stands for Remote Authentication Dial-In User Service—a protocol for centralized authentication commonly used with VPNs.

SAML stands for Security Assertion Markup Language—a standard for exchanging authentication data between identity providers and applications.

Implementing MFA for CMMC

Step 1: Inventory Your Access Points

Identify everywhere MFA must be enforced:

• Windows login (local and domain)
• VPN connections
• Microsoft 365 / email access
• Cloud applications
• Administrative consoles
• Remote desktop connections
• Critical internal applications

Step 2: Choose Your Solution

Select MFA that:

• Integrates with your identity provider
• Supports all your access points
• Fits your budget
• Matches your users’ technical comfort

Step 3: Configure Your Identity Provider

Set up MFA in your identity system:

For Microsoft 365 GCC/GCC High:

1. Enable security defaults or configure Conditional Access
2. Require MFA for all users
3. Configure Microsoft Authenticator as primary method
4. Set up backup methods (phone, hardware token)

For other identity providers:

• Follow vendor documentation
• Enable MFA policies for all users
• Configure appropriate authentication methods

Step 4: Enroll Users

Roll out MFA to your organization:

• Communicate the change in advance
• Provide clear enrollment instructions
• Offer help desk support during rollout
• Set enrollment deadlines
• Follow up with users who have not enrolled

Step 5: Configure Backup Methods

Ensure users can still access systems if their primary MFA method fails:

• Configure backup phone numbers
• Issue backup hardware tokens to critical users
• Create break-glass accounts for emergencies (secured separately)
• Document recovery procedures

Step 6: Document for Assessors

Create evidence of your MFA implementation:

• Screenshots showing MFA is required
• Policy requiring MFA for access
• Configuration documentation
• User enrollment records

Common MFA Implementation Mistakes

Mistake 1: Excluding Users or Systems

Every user and system in your CUI environment needs MFA. Exceptions create compliance gaps and security vulnerabilities.

Mistake 2: Relying Only on SMS

While SMS MFA meets minimum requirements, it is vulnerable to attacks. Use authenticator apps or hardware tokens when possible.

Mistake 3: No Backup Methods

When users lose phones or tokens, they cannot work. Configure backup authentication methods to prevent lockouts.

Mistake 4: Not Enforcing MFA Everywhere

MFA on email but not VPN creates a gap. Enforce MFA on all access paths to CUI systems.

Mistake 5: Poor User Communication

Surprise MFA rollouts frustrate users and overwhelm help desks. Communicate early and provide support.

MFA and the User Experience

Users sometimes resist MFA as inconvenient. Address this by:

Making It Easy

• Use push notifications instead of code entry when possible
• Enable “remember this device” for trusted computers (with appropriate policy)
• Provide multiple authentication options

Explaining the Why

• Help users understand MFA protects their accounts and the company
• Share examples of breaches prevented by MFA
• Connect MFA to contract requirements and job security

Providing Support

• Offer help desk assistance during and after rollout
• Create clear self-service documentation
• Be patient with less technical users

Key Takeaways

MFA is explicitly required for CMMC Level 2 compliance, covering both privileged and non-privileged network access. Authenticator apps and hardware tokens are the strongest options, while SMS should be avoided when possible.

Choose an MFA solution that integrates with your existing identity provider and covers all access points to CUI systems. Implement backup methods to prevent lockouts and document your configuration for assessors.

Start MFA implementation early in your compliance journey—it is foundational to many other security controls.

Related Articles:

• What is CMMC Level 2?
• CMMC Identification and Authentication Requirements
• Essential Tools for CMMC Compliance
• NIST SP 800-171 Rev 2 – Identification and Authentication
• 32 CFR Part 170 – CMMC Program Rule

Official Sources: This article is based on NIST SP 800-171 Revision 2 Identification and Authentication requirements (Section 3.5) and 32 CFR Part 170. Product recommendations should be evaluated for your specific environment.

Need help implementing MFA for CMMC compliance? Contact Greypike for expert guidance on Level 1 and Level 2 certification, or get started with Obolix to streamline your compliance journey.