Short answer: yes — if you handle Controlled Unclassified Information (CUI), CMMC Level 2 requires multi-factor authentication. It's not a "nice to have" or a best-practice suggestion. It's a specific, named control, and it's one of the few you are not allowed to defer. This guide explains exactly where MFA applies, what counts as MFA, and why you can't push it down the road.
If you're a small defense subcontractor trying to figure out the real technical requirements without wading through 300 pages of federal regulation, this is the plain-English version.
Does CMMC Require MFA?
Yes. The requirement lives in NIST SP 800-171 control IA.L2-3.5.3, which every CMMC Level 2 assessment measures. The control reads:
"Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts."
In plain terms: anyone with admin rights needs MFA to log in, whether they're sitting at the machine or connecting remotely — and every regular user needs MFA when logging in over a network (VPN, remote desktop, cloud apps like Microsoft 365).
This only applies to Level 2, which covers companies that store, process, or transmit CUI. If you only handle Federal Contract Information (FCI) and need Level 1, MFA is not one of the 15 Level 1 requirements — though enabling it anyway is still smart security.
Where Exactly Do You Have to Use MFA?
The control is precise about which combinations of user and access type are covered. This table is worth memorizing, because assessors check each cell:
| Account type | Local access (at the machine) | Network access (remote / cloud) |
|---|---|---|
| Privileged (admins) | MFA required | MFA required |
| Non-privileged (regular users) | Not required by 3.5.3 | MFA required |
The one gap — local, at-the-keyboard login for a regular user — is not required by this specific control. In practice, most small shops turn MFA on everywhere anyway, because managing exceptions is more work than just applying it uniformly, and it strengthens several other controls at the same time.
What Actually Counts as MFA?
Multi-factor means two or more different types of factor, not two passwords. The recognized categories are:
- Something you know — a password or PIN
- Something you have — a phone with an authenticator app, a hardware token, a smart card
- Something you are — a fingerprint or face scan
A password plus a security question is not MFA — both are "something you know." You need factors from two different categories. Here's how the common methods stack up for a CMMC environment:
| Method | Strength for CMMC |
|---|---|
| Hardware security key (FIDO2) | Strongest. Phishing-resistant. Ideal for admins. |
| PIV / CAC smart card | Very strong; ties into government-grade cryptographic modules. |
| Authenticator app (TOTP / push) | Solid and widely used. Prefer number-matching push to resist "MFA fatigue." |
| SMS text-message code | Weakest. Allowed but discouraged — codes can be intercepted or phished. |
SMS is not banned outright, but if an assessor sees it protecting admin access to your CUI environment, expect questions. Where you have a choice, choose a phishing-resistant method. Some hardware tokens and smart cards also connect to the FIPS-validated cryptography that other CMMC controls require — a bonus when you're already buying them.
Why MFA Is Non-Negotiable for Your Score
CMMC Level 2 scoring starts at 110 and subtracts points for gaps. MFA is one of the heaviest single deductions on the board. Miss it and you lose 5 points off the top — and because it can't be deferred, an open MFA gap can block certification entirely, not just lower your SPRS score.
That combination — high point value plus no-deferral — is why experienced assessors treat MFA as a "day one" item. It's cheap to fix relative to its weight, so there's no good reason to walk into an assessment without it.
Of all 110 controls, MFA offers one of the best returns on effort: modest cost, big score impact, and it genuinely reduces your risk of a breach.
Common Ways Small Contractors Get MFA Wrong
Turning MFA "on" is easy. Turning it on correctly and completely is where audits catch people:
- Admin accounts left out. Break-glass and service admin accounts are exactly the ones attackers want — and exactly the ones people forget to enroll.
- One cloud app covered, others not. MFA on email but not on the file-share or the VPN leaves a hole in the boundary.
- No evidence. The control being on isn't enough; you need to show a configuration screenshot or policy export proving it's enforced, not optional.
- Local admin logins ignored. If a privileged user can log in at the console without a second factor, that's a finding — 3.5.3 covers local privileged access too.
Know exactly which controls you're missing
CMMC Map walks you through all 110 Level 2 controls in plain English — flags high-value items like MFA that can't be deferred, and builds your SSP and POA&M as you answer.
Start Your Free 7-Day TrialA Quick Note on CUI Safety
MFA protects the doors to your CUI — but it doesn't change the golden rule: never paste actual CUI into a chatbot, AI tool, or any system outside your assessed boundary. That includes CMMC Map. Our guidance walks you through how to implement and document controls; the real CUI stays inside the protected environment you're building. Keeping sensitive government data out of unapproved tools is itself part of good CMMC hygiene.
Where MFA Fits in the CMMC Timeline
The phased rollout is already underway. Phase 1 began November 10, 2025, when self-assessment requirements started appearing in new DoD solicitations. Phase 2 — which would have begun November 10, 2026 — was suspended on July 13, 2026 pending a 60-day reform review, so third-party C3PAO assessments are on hold. That does not let you off MFA: it is scored in your NIST 800-171 self-assessment, it carries a 5-point SPRS deduction when missing, and self-assessment is now the primary enforcement mechanism. This is still a fix to make now.