03.05.03: Multi-Factor Authentication
Control Family:
Previous Version:
- NIST Special Publication 800-171 Revision 2:
- 3.5.3: Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts
Requirements
- Implement multi-factor authentication for access to privileged and non-privileged accounts.
Discussion
This requirement applies to user accounts. Multi-factor authentication requires the use of two or more different factors to achieve authentication. The authentication factors are defined as follows: something you know (e.g., a personal identification number ), something you have (e.g., a physical authenticator, such as a cryptographic private key), or something you are (e.g., a biometric). Multi-factor authentication solutions that feature physical authenticators include hardware authenticators that provide time-based or challenge-response outputs and smart cards. In addition to authenticating users at the system level, organizations may also employ authentication mechanisms at the application level to provide increased information security.