Autosaved 8s ago
3.5.3[b]objective statement·IMP-0353bDraft
MFA is implemented for local access to privileged accounts.
- Not started
- Draft
- In review
- Approved
Inherits from 3.5.3·
ML
Marcus Leerequested changes · Oct 10
Say which servers are excluded and reference CAPA-024 so the assessor sees the known gap.
Assessment objective · 800-171A Write against this text
Determine if 3.5.3[b] MFA is implemented for local access to privileged accounts.
From 3.5.3 IMP-0353, compiled above this statement in the SSP
MFA is required for all network access through Okta with Duo push or FIDO2 keys . Privileged administrators use FIDO2 hardware keys for console and RDP access to enclave servers via Duo for Windows Logon . Enrollment is verified monthly from the Duo enrollment report . Four legacy CAD servers are not yet covered; see CAPA-024 .
16 words
Local console logon to enclave servers requires Duo for Windows Logon with a FIDO2 key .
Covers wwhwwMissing: Who (role or team that performs or owns it)Where (systems / assets / boundary in scope)When (frequency or trigger)