Draft saved 4s ago
3.5.3[b]Returned
1 of 8
MFA is implemented for local access to privileged accounts.
IMP-0353bDue 2026-10-14Author TOTom OkaforReviewer MLMarcus LeeUpdated 2026-10-10
ML
Marcus Lee returned this for changes · Oct 10
Say which servers are excluded and reference CAPA-024 so the assessor sees the known gap.
Determine if
3.5.3[b] MFA is implemented for local access to privileged accounts.
Answer five prompts
2 of 5 answeredWho
IT Operations administers Duo for Windows Logon; the IT Operations Lead enrolls every Enclave-Admins member. · from PRC-011 §3.2
What
How
Where
Applies to eng-fs-01 and the 6 other enclave servers. Four legacy CAD servers (eng-cad-01…04) are excluded until CAPA-024 closes. · from AST-0112, AST-0131
When
Enforced at every console logon; enrollment is reconciled monthly against the Duo report. · from EVD-0311
Suggested from mapped ISO 27001 A.8.5 statementIMP-ISO-085Approved
“Privileged users authenticate with FIDO2 keys via Duo at every logon. IT Operations owns enrollment and reconciles it monthly against the Duo report.”
Fills Who + When · keeps the mapping in sync
Statement previewOrganization39 words
Duo for Windows Logon with FIDO2 hardware keys enforces MFA for local console logon by privileged accounts. After the AD password, Duo requires a FIDO2 key touch at the console; offline bypass codes are disabled by GPO "Enclave-Duo-Logon" . Where: systems / assets / boundary in scope?Who: role or team that performs or owns it?When: frequency or trigger?
Sources & evidence
AST-0112eng-fs-01Active
Drop evidence for 3.5.3[b]
Final-form only: config exports, screenshots with hostname + date, signed reports.