Short answer: no. CMMC Level 1 does not require multi-factor authentication (MFA).
- What Level 1 requires: every person, program and device proves its identity before it can use company systems.
- MFA: recommended at Level 1, and required at Level 2.
What the rule asks
Practice IA.L1-b.1.vi says to authenticate users, processes and devices before they get access. An assessor checks three things:
- People. Each person signs in with their own account before using company systems.
- Programs. Each app, script or scanner that acts for someone signs in with its own password, key or token, never with a person's login.
- Devices. Each computer requires a login before it can be used. Automatic sign-in is off. Where you can, only company-registered devices can connect, for example devices joined to Microsoft Entra.
What good looks like
- One account per person, and no shared logins such as a common "office" account.
- Every app or service account listed, with how it signs in.
- Every computer marked as needing a login, with automatic sign-in turned off.
How to do it in Microsoft 365
- In the Microsoft 365 admin center (admin.microsoft.com), go to Users → Active users. Check that everyone who works with company information has their own account, and that no mailbox login is shared.
- In Microsoft Entra (entra.microsoft.com), turn on Security defaults, or use a Conditional Access policy, to block older password-only sign-in methods. Service accounts often rely on them. Security defaults is free and also has everyone register for MFA. Conditional Access needs Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium.
- On each Windows computer, require a password or Windows Hello to sign in, and make sure automatic sign-in is off. If you manage devices centrally, you can also require a compliant device before it reaches company data.
The same three checks apply in Google Workspace: one account per person in the Admin console, no shared logins, and a login on every device.
What proof to keep
- A user list or directory export showing one account per person.
- A list of app and service accounts, with how each one signs in.
- Your device list, showing that each device needs a login. A screenshot of the sign-in setting helps.
Common mistakes
- A shared "admin" or "front desk" login that several people use.
- A scanner, backup tool or script that signs in with an employee's account.
- A shop-floor or kiosk computer that signs in automatically.
Should you turn on MFA anyway?
Yes. It is the cheapest way to stop a stolen password from becoming a breach, and Level 2 requires it (IA.L2-3.5.3). Turning it on now means one less change later.
Do it step by step
The Signing in task in ReComply walks through these three checks and keeps the proof in one place, ready for your annual affirmation.
Start free