A stolen password shouldn't be enough to put a government contract at risk, but without the right security controls in place, it can be.
Government contractors regularly work with sensitive information, including engineering drawings, technical specifications, contract documents, and other data that cybercriminals and nation-state threat actors may want to access. While it's easy to imagine these attackers using sophisticated malware to infiltrate government systems, sometimes their way in is much simpler: a compromised employee password.
Multi-Factor Authentication (MFA) helps prevent this by requiring users to verify their identity through more than one authentication factor before accessing an account or system. For government contractors, MFA plays an important role in protecting sensitive information and meeting applicable cybersecurity requirements under frameworks such as NIST SP 800-171 and CMMC.
Traditionally, logging into an account only required a username and password. While this process is convenient, it also creates opportunities for attackers, as passwords can be stolen through phishing, exposed in data breaches, or compromised through credential-based attacks.
MFA adds another layer of verification so that even if an attacker obtains someone's password, they cannot necessarily use it to access the account.
Authentication generally relies on three categories of factors, each providing a different way to verify someone's identity:
For example, an employee logging into a company application might enter their password and then use a hardware security key to complete the login. Even if an attacker managed to steal the password, they would still need to satisfy the additional authentication requirement.
Government contractors often operate within complex networks that connect employees, subcontractors, cloud applications, and government-related systems. These environments can contain Controlled Unclassified Information (CUI), which requires safeguarding under applicable federal requirements even though it isn't classified.
When an attacker compromises an employee account, the consequences can extend well beyond access to an individual inbox. Depending on the permissions associated with that account, an attacker could potentially view sensitive project information, impersonate employees, or use the compromised identity to access other connected systems.
For instance, credential stuffing attacks use stolen username and password combinations to test whether employees have reused credentials across different services. Password spraying takes a different approach by testing a small number of common passwords against numerous accounts, often at a pace designed to avoid triggering account lockouts.
Although MFA generally provides stronger protection than passwords alone, not every authentication method offers the same level of security.
SMS-based authentication, in particular, sends a temporary verification code to a user's phone. While this provides an additional barrier against unauthorized access, attackers may be able to intercept codes through SIM-swapping attacks or by tricking users into entering them on fraudulent websites.
Authenticator apps provide another option by generating time-sensitive codes or sending push notifications to registered devices. These methods avoid some of the risks associated with text messages, but they can still be vulnerable to attacks that capture verification codes or manipulate users into approving fraudulent login requests.
For government contractors, phishing-resistant MFA is especially valuable for privileged accounts and systems containing sensitive information, where unauthorized access could have significant operational or contractual consequences.
Traditional MFA can prevent attackers from logging into an account with a stolen password alone, but it doesn't always protect against attacks that manipulate the authentication process itself.
Consider an employee who receives an email that appears to come from Microsoft 365 and directs them to a login page. The page looks legitimate, so the employee enters their credentials and completes an MFA challenge as they normally would.
What the employee doesn't realize is that the website is controlled by an attacker who is relaying the authentication process to the legitimate Microsoft service. Once the employee completes authentication, the attacker may be able to capture an active session and use it to access the account.
This technique is known as adversary-in-the-middle (AiTM) phishing, and it demonstrates why traditional MFA methods aren't always sufficient against modern credential attacks. Phishing-resistant MFA helps address this weakness by using cryptographic authentication tied to the legitimate website or service.
In short, yes. While MFA creates an important obstacle for attackers, certain techniques can exploit weaknesses in authentication methods, user behavior, or account management processes. Some of the most common approaches include:
Administrative accounts often have access to sensitive configurations, user permissions, and security settings. If one of these accounts is compromised, an attacker may be able to modify security policies, create additional accounts, or expand their access throughout the environment.
Some older applications and authentication protocols don't support modern MFA requirements, which can create alternative access paths that attackers may exploit.
If an organization enables MFA for its primary applications but continues allowing legacy authentication methods, certain systems may remain accessible without the additional verification that employees are required to complete elsewhere.
Identifying and restricting these outdated methods helps ensure that authentication policies are consistently enforced.
Many organizations rely on a combination of cloud applications, VPNs, remote administration tools, and third-party services to support daily operations. Although MFA may be enabled for major platforms such as Microsoft 365, other applications can sometimes fall outside centralized authentication policies.
Without a clear understanding of which systems require MFA and how those requirements are enforced, contractors may unknowingly leave important access points exposed.
Enforcing MFA can prevent unauthorized logins, but the authentication events themselves can also reveal important information about potential attacks.
Repeated failed challenges, unexpected authenticator registrations, unfamiliar sign-in activity, or unusual changes to account settings may indicate that an attacker is attempting to compromise an identity.
Organizations that don't monitor these events may miss early warning signs, even when their MFA controls successfully block individual login attempts.
Improving MFA starts with understanding how employees, administrators, and third-party users access sensitive systems. Contractors should review their existing authentication policies to identify potential gaps and determine whether their controls provide sufficient protection.
A few important steps include:
For contractors preparing for CMMC assessments, these practices can also help demonstrate that authentication controls are properly implemented and operating effectively.
Government contractors need more than an MFA policy on paper. They need confidence that their authentication controls are working as intended and that suspicious activity won't go unnoticed.
RADICL helps Defense Industrial Base organizations strengthen their cybersecurity posture through 24/7 threat monitoring, managed security operations, and hands-on compliance guidance. By helping contractors identify security gaps, monitor potential threats, and navigate NIST 800-171 and CMMC requirements, RADICL connects compliance efforts with practical cybersecurity protection.
Make sure your security controls are doing more than checking a compliance box.
Learn how RADICL can help protect your organization.
MFA is required for government contractors under applicable NIST SP 800-171, CMMC, and contractual cybersecurity requirements. However, specific obligations depend on the contract, the information being handled, and the systems involved.
Phishing-resistant methods such as FIDO2 security keys and properly implemented passkeys provide strong protection against credential phishing. PIV and CAC smart cards can also support phishing-resistant authentication, depending on the implementation and organizational requirements.
MFA can prevent stolen passwords alone from being sufficient for unauthorized access, but some phishing attacks can capture verification codes or authenticated sessions. Phishing-resistant MFA offers stronger protection against attacks that attempt to intercept or relay authentication credentials.