Framework & assessment C

Mockups/§3.7 Framework & assessment

Assessor mode test procedure — External C3PAO assessor mode with no internal nav — only the engagement context bar, objective queue with status tabs, Examine / Interview / Test procedure checklist, evidence acceptance, determination and the auditee request thread, with prev/next.

Traceability graph Risk scoring

Assessor mode|Northbridge C3PAO · CMMC L2 assessment of Acme Defense Systems Window Oct 6 – Oct 17, 2026Results hidden from SPRS until signed

Assessor RK

Met25Not met3N/A0To test4

Requirement 3.5.3 · Use multifactor authentication for local and network access

18 of 32

3.5.3[b]5 ptDetermination statement

Determine if: MFA is implemented for local access to privileged accounts.

Assessment procedure · SP 800-171A potential methods and objects

Examine2/4

Identification and authentication policy

SSP §IA

MFA configuration settings

List of privileged accounts

Interview1/2

System administrators

Personnel with account management duties

Test0/2

MFA mechanism for local console login

MFA for network login (privileged / non-privileged)

Sample (judgment): 4 of 12 enclave servers — eng-fs-01, eng-fs-02, cad-lic-01, nx-build-03

Evidence presented · 1

Console login test — eng-fs-01.png

EVD-0314 · Test result · Jamal Carter · 2026-10-03

Final form

Determination

3.5.3 →Partially tested

Pattern: Vanta a00eebcd context bar + status tabs; b5b7bcfc prev/next; SP 800-171A procedure objects.

Requests & comments3 on this objective

RK
Rachel KimC3PAOrequested evidence· Oct 8, 11:30
Test result shows password-only login at the console of eng-fs-01. Is there a compensating control or an enduring exception documented in the SSP?
DW
Dana Whitfieldreplied· Oct 8, 16:02
No exception — legacy build blocks the Duo agent. CAPA-024 replaces the 4 affected servers by Nov 15.
RK
Rachel KimC3PAOchanged the result· Oct 8, 16:20
Marked NOT MET. 3.5.3 is a 5-point requirement and cannot be placed on a POA&M.

Assigns to owner

Loading mockup…