PR.AA-03 says users, services, and hardware are authenticated. The core control is multifactor authentication on everything that matters, with sensible rules for passwords and a tested plan for emergencies.
What good looks like
MFA is required for all staff on email, the identity provider, cloud consoles, code hosting, and admin tools. Strong authenticators are preferred over text messages where possible. Services and devices authenticate with certificates or tokens, not shared secrets in config files.
NIST's examples: require multifactor authentication, enforce minimum strength for passwords and PINs, periodically reauthenticate users, services, and hardware based on risk, and make sure authorized personnel can reach accounts essential for safety under emergency conditions.
How to implement it
- Enforce MFA at the identity provider and report on exceptions weekly.
- Set a password policy that favors length and blocks known breached passwords.
- Shorten session lifetimes for admin and production access, and require a fresh check for sensitive actions.
- Use certificates or short lived tokens for service to service calls.
- Create two break glass accounts with strong, offline credentials, alert on any use, and test them each quarter.
Evidence to collect
- MFA coverage report by application
- Password and session policy settings
- Break glass procedure and test records
Common gaps
- MFA is on for email but off for the cloud console or code host
- Service accounts use passwords that never change
- Break glass accounts exist but nobody has tested the login
Quick check
Is SMS enough for MFA?
It beats no second factor, but app based or hardware keys resist phishing and SIM swap better. Use the strongest option your tools support for admins first.
Sources
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 2024), Appendix A, CSF Core: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
- NIST CSF 2.0 landing page: https://csrc.nist.gov/pubs/cswp/29/the-nist-cybersecurity-framework-csf-20/final
The CSF is voluntary guidance. There is no CSF certification, so nothing here makes a company "CSF certified". You describe your own practices against the outcomes.
