1Overview
IA.L2-3.5.4 defends authentication against replay. It requires replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts, so that an attacker who captures an authentication exchange cannot simply replay it to gain access. It is a one-point requirement with a single assessment objective, and it may be deferred on a plan of action.
A replay attack captures a valid authentication exchange and re-sends it to impersonate the user, without ever knowing the password. Replay-resistant mechanisms prevent this by making each authentication unique, through nonces, timestamps, or challenge-response, so a captured exchange cannot be reused. This control requires such mechanisms for network access, where the exchange travels over the wire and could be intercepted. Modern authentication protocols are generally replay-resistant by design, so the control is often met by using current protocols rather than legacy ones.
Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.
The requirement targets network access specifically, for both privileged and non-privileged accounts, because that is where an authentication exchange can be captured in transit. Replay resistance is a property of the authentication protocol, and current standards such as Kerberos and modern federated authentication provide it, while some older protocols do not. The control is generally satisfied by relying on replay-resistant protocols and retiring the ones that are vulnerable.
2The Assessment Objective
NIST SP 800-171A frames 3.5.4 as a single objective covering replay-resistant network authentication for both account types.
Replay-resistant authentication mechanisms are implemented for network account access to privileged and non-privileged accounts. Network authentication cannot be replayed.
The single objective is replay-resistant network authentication for both account types. The common failure is legacy protocols that lack replay resistance still enabled somewhere in the environment. The assessor looks for replay-resistant mechanisms across network authentication.
3Failure Patterns
The failures are about legacy protocols and vulnerable authentication paths.
Legacy protocols still enabled
Older authentication protocols that lack replay resistance, left enabled for compatibility, create a vulnerable path even when modern protocols are the norm. Disabling the legacy protocols is usually what closes this.
Weak custom authentication
Custom or application authentication that does not incorporate replay resistance can be vulnerable even when the main directory is not. Such paths need replay-resistant mechanisms too.
Assuming modern protocols without verifying
Assuming replay resistance without confirming which protocols are actually in use can hide a vulnerable fallback. Verifying that network authentication uses replay-resistant protocols is what demonstrates the control.
4Ownership
This is an IT-owned technical control, delivered through the choice of authentication protocols.
| Role | Responsibility for this control |
|---|---|
| IT and system administrator | Ensures network authentication uses replay-resistant protocols and disables vulnerable legacy ones. Owns the technical evidence. |
| Security or compliance lead | Confirms replay resistance across network authentication paths, including custom ones. |
| Program lead | Includes protocol review in periodic checks and retains the evidence. |
5Tooling
The control is delivered by replay-resistant authentication protocols and the retirement of vulnerable ones.
| Objective | Tooling | What it provides |
|---|---|---|
| protocols | Kerberos, modern federated authentication | Replay-resistant network authentication by design. |
| retire | Disabling legacy authentication protocols | Removal of replayable paths left for compatibility. |
The caveat is that a single vulnerable protocol left enabled can undermine the control even where modern authentication dominates. Verifying which protocols are actually in use, and disabling the vulnerable ones, is the substance of the control. The assessor examines the authentication protocols in use, so the legacy fallbacks have to be identified and closed.
6Evidence
The satisfied version of 3.5.4 shows replay-resistant network authentication.
| Evidence | What it demonstrates |
|---|---|
| Authentication protocol configuration | The objective. Replay-resistant protocols in use for network authentication. |
| Legacy protocol status | The objective. Vulnerable protocols disabled. |
The evidence should show that network authentication uses replay-resistant protocols and that vulnerable legacy ones are disabled. The protocol configuration is the clearest demonstration of the control.
A captured login should not be a reusable one
Replay attacks reuse a captured authentication exchange without knowing the password, and this control asks for mechanisms that make each authentication unique. Verifying replay-resistant protocols and retiring vulnerable legacy ones is part of the onsite readiness work this practice does.
Start CMMC Readiness or call 802-335-26627Sources
- NIST Special Publication 800-171 Rev 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, requirement 3.5.4. csrc.nist.gov
- NIST Special Publication 800-171A, Assessing Security Requirements for Controlled Unclassified Information, assessment objective 3.5.4. csrc.nist.gov
- 32 CFR 170.21, Plan of Action and Milestones Requirements, governing which requirements may remain open at a Level 2 assessment. ecfr.gov