IA-02(01) Multi-factor Authentication to Privileged Accounts
All changes in this version
Title
Multi-factor Authentication to Privileged Accounts
Control
Implement multi-factor authentication for access to privileged accounts.
Discussion
Multi-factor authentication requires the use of two or more different factors to achieve authentication. The authentication factors are defined as follows: something you know (e.g., a personal identification number [PIN]), something you have (e.g., a physical authenticator such as a cryptographic private key), or something you are (e.g., a biometric). Multi-factor authentication solutions that feature physical authenticators include hardware authenticators that provide time-based or challenge-response outputs and smart cards such as the U.S. Government Personal Identity Verification (PIV) card or the Department of Defense (DoD) Common Access Card (CAC). In addition to authenticating users at the system level (i.e., at logon), organizations may employ authentication mechanisms at the application level, at their discretion, to provide increased security. Regardless of the type of access (i.e., local, network, remote), privileged accounts are authenticated using multi-factor options appropriate for the level of risk. Organizations can add additional security measures, such as additional or more rigorous authentication mechanisms, for specific types of access.
Related controls
ac-5, ac-6
Assessment objective
IA-02(01) multi-factor authentication is implemented for access to privileged accounts.
STIG rules that implement this control 38
Apple iOS/iPadOS 26 V1R3
- AIOS-26-014800 CAT II Apple iOS/iPadOS 26 must be configured to disable "Auto Unlock" of the iPhone by an Apple Watch.
Apple iOS/iPadOS 27 V1R1
- AIOS-27-013400 CAT II Apple iOS/iPadOS 27 must be configured to disable "Auto Unlock" of the iPhone by an Apple Watch.
Apple macOS 15 (Sequoia) V1R8
- APPL-15-001150 CAT I The macOS system must disable password authentication for SSH.
- APPL-15-003020 CAT II The macOS system must enforce smart card authentication.
- APPL-15-003030 CAT II The macOS system must allow smart card authentication.
- APPL-15-003050 CAT II The macOS system must enforce multifactor authentication for login.
- APPL-15-003051 CAT II The macOS system must enforce multifactor authentication for the su command.
- APPL-15-003052 CAT II The macOS system must enforce multifactor authentication for privilege escalation through the sudo command.
Apple macOS 26 (Tahoe) V1R4
- APPL-26-001150 CAT I The macOS system must disable password authentication for SSH.
- APPL-26-003020 CAT II The macOS system must enforce smart card authentication.
- APPL-26-003030 CAT II The macOS system must allow smart card authentication.
- APPL-26-003050 CAT II The macOS system must enforce multifactor authentication for login.
- APPL-26-003051 CAT II The macOS system must enforce multifactor authentication for the su command.
- APPL-26-003052 CAT II The macOS system must enforce multifactor authentication for privilege escalation through the sudo command.
Application Security and Development V6R5
- APSC-DV-001550 CAT II The application must use multifactor (Alt. Token) authentication for network access to privileged accounts.
- APSC-DV-001590 CAT II The application must use multifactor (Alt. Token) authentication for local access to privileged accounts.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-254010 CAT II Ubuntu 22.04 LTS must have the "SSSD" package installed.
- UBTU-22-254015 CAT II Ubuntu 22.04 LTS must use the "SSSD" package for multifactor authentication services.
- UBTU-22-612010 CAT II Ubuntu 22.04 LTS must implement multifactor authentication for remote access to privileged accounts in such a way that one of the factors is provided by a device separate from the system gaining access.
- UBTU-22-612020 CAT II Ubuntu 22.04 LTS must implement smart card logins for multifactor authentication for local and network access to privileged and nonprivileged accounts.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-100650 CAT II Ubuntu 24.04 LTS must have the "SSSD" package installed.
- UBTU-24-100660 CAT II Ubuntu 24.04 LTS must use the "SSSD" package for multifactor authentication services.
- UBTU-24-400020 CAT II Ubuntu 24.04 LTS must implement smart card logins for multifactor authentication for local and network access to privileged and nonprivileged accounts.
- UBTU-24-400030 CAT II Ubuntu 24.04 LTS must implement smart card logins for multifactor authentication for local and network access to privileged and nonprivileged accounts over SSH.
Google Android 17 COBO Y26M06
- GOOG-17-006200 CAT II Google Android 17 must be configured to disable trust agents.
Microsoft Windows 11 V2R11
- WN11-SO-000251 CAT II Windows 11 must use multifactor authentication for local and network access to privileged and nonprivileged accounts.
Microsoft Windows Server 2025 V1R4
- WN25-DC-000310 CAT II Windows Server 2025 Active Directory (AD) user accounts, including administrators, must be configured to require the use of a common access card (CAC), Personal Identity Verification (PIV)-compliant hardware token, or Alternate Logon Token (ALT) for user authentication.
- WN25-SH-000030 CAT II Windows Server 2025 OpenSSH must accept public key authentication.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-200621 CAT II RHEL 10 must use the common access card (CAC) smart card driver.
- RHEL-10-200730 CAT II RHEL 10 must have the "pkcs11-provider" package installed.
- RHEL-10-700600 CAT II RHEL 10 must be configured so that SSHD accepts public key authentication.
- RHEL-10-701220 CAT II RHEL 10 must enable certificate-based smart card authentication.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-215075 CAT II RHEL 9 must have the openssl-pkcs11 package installed.
- RHEL-09-255035 CAT II RHEL 9 SSHD must accept public key authentication.
- RHEL-09-611160 CAT II RHEL 9 must use the common access card (CAC) smart card driver.
- RHEL-09-611165 CAT II RHEL 9 must enable certificate based smart card authentication.
Samsung Android 16 COBO Y26M10
- KNOX-16-005200 CAT II Samsung Android must be configured to enable a screen-lock policy that will lock the display after a period of inactivity - Disable trust agents.
- KNOX-16-006100 CAT II Samsung Android must be configured to disable authentication mechanisms providing user access to protected data other than a Password Authentication Factor: Face recognition.