Example, read only. A sample company whose own team runs its CMMC program here, reviewed by a credentialed officer and kept current.
IA.L1-3.5.2 · FAR 52.204-21 (b)(1)(vi) · NIST SP 800-171 3.5.2
Authentication
Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems
Reviewed by a credentialed officer on June 12, 2026. The officer advises and never signs; this corroborates your own self assessment and certifies nothing. The finding, and the affirmation, stay yours.
Who is accountable for this safeguard
They get the reminder when this evidence goes stale. Carries into next year's cycle.
What it means
Before letting anyone into your systems, verify they are who they say they are, typically a password plus a second factor (MFA).
Why it matters
This is the control primes scrutinize most. Password-only access is a near-automatic rejection in 2026. MFA on all admin accounts is the floor.
The proof on file
- MFA registration report (Microsoft 365)Pulled read only from Microsoft 365 · June 10, 2026On file
- Access and session policies (Microsoft 365)Pulled read only from Microsoft 365 · June 10, 2026On file
The narrative on file
All accounts require a password meeting the company policy plus multi factor authentication through Microsoft Authenticator. MFA is enforced by an access policy for every user in the tenant, and the MFA registration report and the access policies are pulled read only from Microsoft 365.
You answer in plain English. Charlie drafts the narrative for your System Security Plan, and you confirm it.
What makes it pass
- Tenant-level MFA / 2-Step policy is visible and shows status = Enabled / Enforced
- Per-user enrollment report shows MFA status for every account (no users left at 'Disabled')
- Any MFA-exempt accounts (break-glass, service) are documented with a reason
- Date of capture visible
Assessment objectives, NIST SP 800-171A
The team at Cedar Ridge Machine Works, LLC confirmed this safeguard MET. The evidence above is a living document: refresh rosters, devices, and accounts whenever the business changes and the safeguard stays current. The single signature happens in Attest & file, once all 17 are met.
Next safeguard →Need the exact clicks?Microsoft 365, step by step
- 1Go to admin.microsoft.com → Security & compliance (or entra.microsoft.com → Protection → Conditional Access)
- 2Open the policy that enforces MFA (often 'Require MFA for all users' or Security Defaults)
- 3Screenshot the policy showing it is enabled and applies to all users
- 4Also capture Users → Active users → filter 'MFA status: Enforced' to show coverage
Capture: Two screenshots: (1) the Conditional Access policy or Security Defaults page showing MFA is on, (2) the user list showing MFA enforced per account.
This is one of 17
Answer in plain English, file the proof, confirm it MET.
The team at Cedar Ridge Machine Works, LLC walked all 17 the same way. The platform explains each one in plain English and tells you what proof to grab or pulls it from Microsoft 365, Charlie drafts the paperwork with you, a credentialed officer reviews it, and your team confirms each one MET. The self assessment stays your act. Start free for 30 days, no credit card, or book a free advisory call if you would rather talk it through first.