Requirements / Identification and Authentication (IA)
IA.L2-3.5.4
Replay-Resistant Authentication
Official Source Material
Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.
Determine if:
- [a] replay-resistant authentication mechanisms are implemented for network account access to privileged and non-privileged accounts.
Source: CMMC Assessment Guide - Level 2, Version 2.13, September 2024
Practitioner Guidance
How to meet it
A current Windows and TLS stack already resists replay. Your job is turning off the parts that do not.
A replay attack captures sign-in traffic and sends it again to impersonate the original user. Kerberos, the sign-in protocol inside Windows domains, TLS on web applications, and time-based MFA codes all resist replay by design. Set NTLMv2 as the minimum authentication level, disable SMBv1, and retire services that still authenticate over cleartext protocols. The single objective [a] is then covered for privileged and non-privileged accounts alike.
Evidence is configuration, not packet captures.
Show the Group Policy or directory settings enforcing Kerberos and the NTLMv2 minimum, the TLS configuration on web services, and the MFA solution rejecting reused codes. The configuration itself is the demonstration. A packet capture adds nothing an assessor needs.
Your MFA deployment is doing double duty here.
The time-synchronous and challenge-response one-time mechanisms deployed for IA.L2-3.5.3 are exactly the replay-resistant techniques the requirement's discussion names. Where MFA covers network access, this requirement rides along with it.
What falls short
- Legacy protocols still answering: Telnet, FTP with credentials, HTTP basic authentication without TLS, or NTLMv1. Traffic captured on any of these can be replayed, so [a] fails on that path.
Edge cases
- A cloud provider's own compliance documentation may call for stronger authentication, such as smart card certificates, than this requirement does. You are assessed against the requirement, not the provider's customer responsibility matrix, and time-based MFA satisfies [a] in any tenant.