Is MFA required for CPCSC Level 1?

Indeed, multifactor authentication (MFA) is a mandatory requirement for CPCSC Level 1. Requirement 03.05.03 outlines MFA as one of the 13 essential requirements for Level 1 certification. According to the PSPC's (Private Security Patrol Corporation) guidance, MFA is essential for privileged accounts and any systems storing Specified Information. It is advisable to implement MFA across all accounts that interact with these systems.

The explanation provided by the PSPC's overview places MFA under control 7 within the Level 1 set, which falls under identification and authentication. The how-to page further clarifies the duty as requiring MFA for both privileged accounts and systems storing Specified Information. This guidance is reinforced by ITSP 10.171 and the PSPC's assessment criteria, which cover both privileged and non-privileged accounts.

It is prudent to adhere to this broader scope, as gaps in coverage for ordinary user accounts could prove challenging to defend.

MFA is a relatively inexpensive solution that, if neglected, could result in significant difficulties during the attestation process. Given that CMMC (Cybersecurity Maturity Model Certification) shops often encounter this requirement unexpectedly, it is imperative for Level 1 shops to prioritize MFA implementation. While the American Level 1 certification does not mandate MFA, passing such a certification without MFA for Level 1 operations does not validate adherence to the more stringent CPCSC standards.

The scope of systems covered by MFA requirements can vary depending on the boundary established by the shop. If Specified Information is housed in an enclave file share, email system, or accessible via remote access, appropriate MFA measures must be applied to all relevant logins and administrative accounts managing these systems. Proper scoping is crucial, and the PSPC’s scoping page provides guidance on delineating these boundaries effectively.

When determining the appropriate MFA method, authenticator apps are recommended due to their widespread support and robust security features. Hardware keys are also a viable option, although SMS-based MFA is the least secure and should be avoided, particularly for administrative accounts. Evidence of MFA implementation can be as simple as dated screenshots of the MFA configuration for each system, which can be filed to demonstrate compliance.

Remote access poses additional considerations. Any VPN or remote desktop gateway that grants access to the enclave should be treated as a privileged path. Ensuring MFA is enforced on both the Microsoft 365 sign-in and the VPN is essential. Failure to secure both entry points could create a security vulnerability, with the front door (Microsoft 365) locked while the side door (VPN) remains unsecured.

The consequences of overlooking MFA requirements can largely be mitigated by ensuring proper attestation. The Level 1 certification process does not involve routine evidence reviews, and the signature obtained during the attestation process carries significant weight. Delaying attestation for a couple of weeks to implement MFA is preferable to signing the attestation without proper safeguards in place.

To begin, compile a list of all systems that store or can access Specified Information, including email systems and remote access platforms. Identify every privileged account associated with these systems and subsequently enumerate all ordinary user accounts. Prioritize the implementation of MFA for administrative accounts, followed by the rest of the accounts.

Document each MFA configuration with a dated screenshot, storing these records under requirement 03.05.03. This proactive approach to MFA implementation will solidify compliance with CPCSC Level 1 requirements. Further guidance on the remaining 12 Level 1 requirements can be found on the Level 1 page, and short notes on these requirements are available through CPCSC Bytes. For a tailored scoping assessment, consider booking a scoping call.