Supplier Cybersecurity Assessment
v3 draftCMMC L2 flow-down · DFARS 252.204-7012 / -7021
Saved · v2 live
Section 3 · Access control & MFA
3.1 →
NIST SP 800-171 3.5.3 requires MFA for network access and for local access to privileged accounts.
AFIDO2 / hardware key10 pts
BAuthenticator app (TOTP / push)8 pts
CSMS one-time code3 ptsauto-flag
DNone0 ptsauto-flag
Choose as many as apply
* Required