What is MFA? Multi-Factor Authentication for Government Contractors

A stolen password shouldn't be enough to put a government contract at risk, but without the right security controls in place, it can be.

Government contractors regularly work with sensitive information, including engineering drawings, technical specifications, contract documents, and other data that cybercriminals and nation-state threat actors may want to access. While it's easy to imagine these attackers using sophisticated malware to infiltrate government systems, sometimes their way in is much simpler: a compromised employee password.

Multi-Factor Authentication (MFA) helps prevent this by requiring users to verify their identity through more than one authentication factor before accessing an account or system. For government contractors, MFA plays an important role in protecting sensitive information and meeting applicable cybersecurity requirements under frameworks such as NIST SP 800-171 and CMMC.

Multi-Factor Authentication explained

Traditionally, logging into an account only required a username and password. While this process is convenient, it also creates opportunities for attackers, as passwords can be stolen through phishing, exposed in data breaches, or compromised through credential-based attacks.

MFA adds another layer of verification so that even if an attacker obtains someone's password, they cannot necessarily use it to access the account.

Authentication generally relies on three categories of factors, each providing a different way to verify someone's identity:

• Something you know: Information such as a password or PIN, which can be vulnerable to phishing, password reuse, and credential theft.
• Something you have: A physical or digital authenticator, such as a hardware security key or an authenticator app installed on a trusted device.
• Something you are: Biometric characteristics, including fingerprints and facial recognition, that can be used as part of the authentication process.

For example, an employee logging into a company application might enter their password and then use a hardware security key to complete the login. Even if an attacker managed to steal the password, they would still need to satisfy the additional authentication requirement. 

Why MFA is important for government contractors

Government contractors often operate within complex networks that connect employees, subcontractors, cloud applications, and government-related systems. These environments can contain Controlled Unclassified Information (CUI), which requires safeguarding under applicable federal requirements even though it isn't classified.

When an attacker compromises an employee account, the consequences can extend well beyond access to an individual inbox. Depending on the permissions associated with that account, an attacker could potentially view sensitive project information, impersonate employees, or use the compromised identity to access other connected systems.

For instance, credential stuffing attacks use stolen username and password combinations to test whether employees have reused credentials across different services. Password spraying takes a different approach by testing a small number of common passwords against numerous accounts, often at a pace designed to avoid triggering account lockouts.

Are all MFA methods equally secure?

Although MFA generally provides stronger protection than passwords alone, not every authentication method offers the same level of security.

SMS-based authentication, in particular, sends a temporary verification code to a user's phone. While this provides an additional barrier against unauthorized access, attackers may be able to intercept codes through SIM-swapping attacks or by tricking users into entering them on fraudulent websites.

Authenticator apps provide another option by generating time-sensitive codes or sending push notifications to registered devices. These methods avoid some of the risks associated with text messages, but they can still be vulnerable to attacks that capture verification codes or manipulate users into approving fraudulent login requests.

For government contractors, phishing-resistant MFA is especially valuable for privileged accounts and systems containing sensitive information, where unauthorized access could have significant operational or contractual consequences.

What is phishing-resistant MFA?

Traditional MFA can prevent attackers from logging into an account with a stolen password alone, but it doesn't always protect against attacks that manipulate the authentication process itself.

Consider an employee who receives an email that appears to come from Microsoft 365 and directs them to a login page. The page looks legitimate, so the employee enters their credentials and completes an MFA challenge as they normally would.

What the employee doesn't realize is that the website is controlled by an attacker who is relaying the authentication process to the legitimate Microsoft service. Once the employee completes authentication, the attacker may be able to capture an active session and use it to access the account.

This technique is known as adversary-in-the-middle (AiTM) phishing, and it demonstrates why traditional MFA methods aren't always sufficient against modern credential attacks. Phishing-resistant MFA helps address this weakness by using cryptographic authentication tied to the legitimate website or service.

Can attackers bypass MFA?

In short, yes. While MFA creates an important obstacle for attackers, certain techniques can exploit weaknesses in authentication methods, user behavior, or account management processes. Some of the most common approaches include:

• MFA fatigue attacks: Attackers repeatedly send authentication requests to a user's device, hoping the employee will eventually approve one out of frustration or confusion.
• Adversary-in-the-middle (AiTM) attacks: Attackers use convincing phishing websites to relay the authentication process and potentially capture an authenticated session, allowing them to access an account without repeating the original MFA challenge.
• Account recovery exploitation: Attackers impersonate legitimate users and attempt to convince help desk personnel to reset authentication settings or register new devices, potentially undermining otherwise strong authentication controls.

Common MFA mistakes government contractors make

Administrative accounts often have access to sensitive configurations, user permissions, and security settings. If one of these accounts is compromised, an attacker may be able to modify security policies, create additional accounts, or expand their access throughout the environment.

Leaving Legacy Authentication enabled

Some older applications and authentication protocols don't support modern MFA requirements, which can create alternative access paths that attackers may exploit.

If an organization enables MFA for its primary applications but continues allowing legacy authentication methods, certain systems may remain accessible without the additional verification that employees are required to complete elsewhere.

Identifying and restricting these outdated methods helps ensure that authentication policies are consistently enforced.

Assuming MFA covers every application

Many organizations rely on a combination of cloud applications, VPNs, remote administration tools, and third-party services to support daily operations. Although MFA may be enabled for major platforms such as Microsoft 365, other applications can sometimes fall outside centralized authentication policies.

Without a clear understanding of which systems require MFA and how those requirements are enforced, contractors may unknowingly leave important access points exposed.

Failing to monitor authentication activity

Enforcing MFA can prevent unauthorized logins, but the authentication events themselves can also reveal important information about potential attacks.

Repeated failed challenges, unexpected authenticator registrations, unfamiliar sign-in activity, or unusual changes to account settings may indicate that an attacker is attempting to compromise an identity.

Organizations that don't monitor these events may miss early warning signs, even when their MFA controls successfully block individual login attempts.

How government contractors can strengthen MFA

Improving MFA starts with understanding how employees, administrators, and third-party users access sensitive systems. Contractors should review their existing authentication policies to identify potential gaps and determine whether their controls provide sufficient protection.

A few important steps include:

• Prioritize phishing-resistant MFA. Implement stronger authentication methods, particularly for privileged accounts and systems handling CUI.
• Review access across applications. Ensure MFA requirements extend to relevant cloud services, VPNs, remote access tools, and administrative accounts.
• Secure account recovery procedures. Establish identity verification processes for password resets, authenticator enrollment, and account recovery requests.
• Monitor suspicious authentication activity. Investigate repeated MFA failures, unusual sign-in attempts, and unexpected changes to authentication settings.
• Regularly test and document controls. Verify that MFA is functioning as intended and maintain evidence to support applicable NIST 800-171 and CMMC requirements.

For contractors preparing for CMMC assessments, these practices can also help demonstrate that authentication controls are properly implemented and operating effectively.

Strengthen Identity Security with RADICL

Government contractors need more than an MFA policy on paper. They need confidence that their authentication controls are working as intended and that suspicious activity won't go unnoticed.

RADICL helps Defense Industrial Base organizations strengthen their cybersecurity posture through 24/7 threat monitoring, managed security operations, and hands-on compliance guidance. By helping contractors identify security gaps, monitor potential threats, and navigate NIST 800-171 and CMMC requirements, RADICL connects compliance efforts with practical cybersecurity protection.

Make sure your security controls are doing more than checking a compliance box.

Learn how RADICL can help protect your organization.

FAQs

Is MFA required for government contractors?

MFA is required for government contractors under applicable NIST SP 800-171, CMMC, and contractual cybersecurity requirements. However, specific obligations depend on the contract, the information being handled, and the systems involved.

What is the best MFA method for government contractors?

Phishing-resistant methods such as FIDO2 security keys and properly implemented passkeys provide strong protection against credential phishing. PIV and CAC smart cards can also support phishing-resistant authentication, depending on the implementation and organizational requirements.

Can MFA prevent phishing attacks?

MFA can prevent stolen passwords alone from being sufficient for unauthorized access, but some phishing attacks can capture verification codes or authenticated sessions. Phishing-resistant MFA offers stronger protection against attacks that attempt to intercept or relay authentication credentials.