← Back to General Application (GAPP) Security Requirements Guide

V-288136

CAT I (High)

The application must use multifactor authentication (MFA).

Rule ID

SV-288136r1252911_rule

STIG

General Application (GAPP) Security Requirements Guide

Version

V1R0.1

CCIs

CCI-000765 CCI-000766 CCI-004046 CCI-000778 CCI-001953 CCI-001954 CCI-002009 CCI-002010 CCI-004046 CCI-004047

Discussion

Without the use of MFA, the ease of access to privileged functions is greatly increased. MFA requires the use of two or more factors to achieve authentication. Factors include: (i) Something a user knows (e.g., password/PIN); (ii) Something a user has (e.g., cryptographic identification device, token); or (iii) Something a user is (e.g., biometric). The current DoW multifactor solution is the common access card (CAC). Other DoW or authorizing official (AO)-approved solutions may be implemented.

Check Content

Review application documentation and configuration settings to determine if the application is using an approved MFA solution to authenticate organizational users.

If an approved MFA solution is not being used, this is a finding.

Fix Text

Configure the application to use an approved MFA solution to uniquely identify and authenticate organizational users.