IA-02(06) Access to Accounts —separate Device
All changes in this version
Title
Access to Accounts —separate Device
Control
Implement multi-factor authentication for [Selection (one or more): local; network; remote] access to [Selection (one or more): privileged accounts; non-privileged accounts] such that:
(a) One of the factors is provided by a device separate from the system gaining access; and
(b) The device meets [Assignment: strength of mechanism requirements].
Discussion
The purpose of requiring a device that is separate from the system to which the user is attempting to gain access for one of the factors during multi-factor authentication is to reduce the likelihood of compromising authenticators or credentials stored on the system. Adversaries may be able to compromise such authenticators or credentials and subsequently impersonate authorized users. Implementing one of the factors on a separate device (e.g., a hardware token), provides a greater strength of mechanism and an increased level of assurance in the authentication process.
Parameters
ia-02.06_odp.01: [local; network; remote]
ia-02.06_odp.02: [privileged accounts; non-privileged accounts]
ia-02.06_odp.03: strength of mechanism requirements
Related controls
ac-6
STIG rules that implement this control 31
Apple macOS 15 (Sequoia) V1R8
- APPL-15-001150 CAT I The macOS system must disable password authentication for SSH.
- APPL-15-003020 CAT II The macOS system must enforce smart card authentication.
- APPL-15-003050 CAT II The macOS system must enforce multifactor authentication for login.
- APPL-15-003051 CAT II The macOS system must enforce multifactor authentication for the su command.
- APPL-15-003052 CAT II The macOS system must enforce multifactor authentication for privilege escalation through the sudo command.
Apple macOS 26 (Tahoe) V1R4
- APPL-26-001150 CAT I The macOS system must disable password authentication for SSH.
- APPL-26-003020 CAT II The macOS system must enforce smart card authentication.
- APPL-26-003050 CAT II The macOS system must enforce multifactor authentication for login.
- APPL-26-003051 CAT II The macOS system must enforce multifactor authentication for the su command.
- APPL-26-003052 CAT II The macOS system must enforce multifactor authentication for privilege escalation through the sudo command.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-254010 CAT II Ubuntu 22.04 LTS must have the "SSSD" package installed.
- UBTU-22-254015 CAT II Ubuntu 22.04 LTS must use the "SSSD" package for multifactor authentication services.
- UBTU-22-612010 CAT II Ubuntu 22.04 LTS must implement multifactor authentication for remote access to privileged accounts in such a way that one of the factors is provided by a device separate from the system gaining access.
- UBTU-22-612020 CAT II Ubuntu 22.04 LTS must implement smart card logins for multifactor authentication for local and network access to privileged and nonprivileged accounts.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-100650 CAT II Ubuntu 24.04 LTS must have the "SSSD" package installed.
- UBTU-24-100660 CAT II Ubuntu 24.04 LTS must use the "SSSD" package for multifactor authentication services.
Microsoft Windows Server 2022 V2R11
- WN22-DC-000310 CAT II Windows Server 2022 Active Directory user accounts, including administrators, must be configured to require the use of a Common Access Card (CAC), Personal Identity Verification (PIV)-compliant hardware token, or Alternate Logon Token (ALT) for user authentication.
Microsoft Windows Server 2025 V1R4
- WN25-DC-000310 CAT II Windows Server 2025 Active Directory (AD) user accounts, including administrators, must be configured to require the use of a common access card (CAC), Personal Identity Verification (PIV)-compliant hardware token, or Alternate Logon Token (ALT) for user authentication.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-200610 CAT II RHEL 10 must have the "pcsc-lite" package installed.
- RHEL-10-200611 CAT II RHEL 10 must have the "pcscd" socket set to active.
- RHEL-10-200612 CAT II RHEL 10 must have the "pcsc-lite-ccid" package installed.
- RHEL-10-200620 CAT II RHEL 10 must have the "opensc" package installed.
- RHEL-10-200730 CAT II RHEL 10 must have the "pkcs11-provider" package installed.
- RHEL-10-701220 CAT II RHEL 10 must enable certificate-based smart card authentication.
- RHEL-10-701230 CAT II RHEL 10 must implement certificate status checking for multifactor authentication.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-215075 CAT II RHEL 9 must have the openssl-pkcs11 package installed.
- RHEL-09-611165 CAT II RHEL 9 must enable certificate based smart card authentication.
- RHEL-09-611170 CAT II RHEL 9 must implement certificate status checking for multifactor authentication.
- RHEL-09-611175 CAT II RHEL 9 must have the pcsc-lite package installed.
- RHEL-09-611180 CAT II The pcscd socket on RHEL 9 must be active.
- RHEL-09-611185 CAT II RHEL 9 must have the opensc package installed.