Compliancemanzill.com
NIST 800-53 rev.5

NIST 800-53 rev.5/Identification and Authentication/338 of 1011

IA-02 (06)Identification and Authentication (organizational Users) | Access to Accounts —separate Device

Control family: Identification and Authentication

Control description

Implement multi-factor authentication for [Selection (one or more): local; network; remote] access to [Selection (one or more): privileged accounts; non-privileged accounts] such that:

(a) One of the factors is provided by a device separate from the system gaining access; and

(b) The device meets [Assignment: organization-defined strength of mechanism requirements].

How to implement

Coming in phase 2Step-by-step guidance for implementing this control on Microsoft Azure, using services such as Azure Policy, Microsoft Defender for Cloud and Entra ID. It will be matched to your environment.