CMMC Level 2 self-assessmentIn progress
NIST SP 800-171 r2 · 800-171A objectives · CUI enclave scope · due Dec 15
Met268Not met29N/A9Not assessed14
SPRS score
71 / 110
No CMMC status
7 items block a POA&M · need ≥ 88
Families 14
3.5.3IA — Identification and Authentication5 ptNot eligible · weight > 1
Use multifactor authentication for local and network access
Not metOwner DWDana Whitfield
Objectives met3 of 4
Assessment objectives (800-171A) One NOT MET objective fails the requirement
3.5.3[a]Privileged accounts are identified.1/1
3.5.3[b]MFA is implemented for local access to privileged accounts.0/13
3.5.3[c]MFA is implemented for network access to privileged accounts.2/2
3.5.3[d]MFA is implemented for network access to non-privileged accounts.1/2
3.5.3[b]
Determine if: MFA is implemented for local access to privileged accounts.
- RKRachel KimC3PAOrequested evidence· Oct 8, 11:30
Test result shows password-only login at the console of eng-fs-01. Is there a compensating control or an enduring exception documented in the SSP?
- DWDana Whitfieldreplied· Oct 8, 16:02
No exception — legacy build blocks the Duo agent. CAPA-024 replaces the 4 affected servers by Nov 15.
- RKRachel KimC3PAOchanged the result· Oct 8, 16:20
Marked NOT MET. 3.5.3 is a 5-point requirement and cannot be placed on a POA&M.
Visible to Northbridge C3PAO