The VMM must implement multifactor authentication for remote access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.

Using an authentication device, such as a CAC or token that is separate from the VMM, ensures that even if the VMM is compromised, that compromise will not affect credentials stored on the authentication device.

Multifactor solutions that require devices separate from VMMs gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoW common access card.

A privileged account is defined as a VMM account with authorizations of a privileged user.

Remote access is access to DoW nonpublic VMMs by an authorized user (or a VMM) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.

Verify the VMM implements multifactor authentication for remote access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.

If it does not, this is a finding.

Configure the VMM to implement multifactor authentication for remote access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.