MFA requirements compared across compliance frameworks

The effort depends mainly on how many access paths the frameworks cover and how many of them already enforce MFA. Map each path separately: administrative and general access into the cardholder data environment under PCI DSS 8.4.1 and 8.4.2, remote access from outside the network including vendors under 8.4.3, internet-facing applications under CIS Safeguard 6.3, and Interactive Remote Access sessions under NERC CIP-005-7 Part 2.3. The authentication method also changes scope. PCI SSC FAQ 1595 says FIDO2-compliant synced passkeys qualify for 8.4.2, while FAQ 1596 says phishing-resistant authentication alone does not satisfy 8.4.1 or 8.4.3. Legacy applications, service accounts and third-party services that cannot accept a second factor add exception work. Confirm each of these in a written quote before scoping.

An identity team can usually own the core work, including identity provider policy, enrollment, conditional access and recovery flows, but it rarely owns the whole rollout. Application owners control whether a system accepts a second factor, network teams control remote access paths, and procurement controls which vendors need MFA. Assessed evidence adds another dependency. A PCI DSS assessment is documented on a Report on Compliance or Self-Assessment Questionnaire with an Attestation of Compliance, and a CMMC Level 2 requirement counts as MET only when its assessment objectives are satisfied with evidence in final form. Ask the implementation partner to state in writing which tasks the identity team keeps and which need application, network or compliance owners.

The identity team needs to supply the facts that define scope and the controls that enforce it. Expect to provide:

• An inventory of every access path to in-scope systems, including administrative, remote, vendor and internet-facing access.
• Current directory and single sign-on configuration, with conditional access policies that can enforce a second factor for each path.
• An enrollment and recovery process that works for contractors and third parties, not only employees.
• A documented exception process with named owners and review dates.
• Authentication logs and change records that an assessor can sample.

Skilled identity staff can build these, but the assessor will test them. Ask the quote to name who produces each artifact and how long the team will support questions during assessment.

One MFA deployment can often serve several frameworks, because the requirements overlap. CIS accepts MFA enforced centrally by a directory service or single sign-on provider as meeting Safeguard 6.3, and the CIS Controls Navigator for v8.1 maps CIS to PCI DSS v4.0, CMMC v2.0, DORA and NIS2. Mappings still have limits. ENISA states that its mapping is not a measure of equivalence and does not assess whether a standard fully covers a regulation, and NIST does not check the correctness of non-NIST mappings. Each framework also has its own scope. PCI DSS covers the cardholder data environment, NERC CIP covers Interactive Remote Access, and CMMC covers systems that handle CUI. Plan one enforcement layer, then produce separate evidence for each assessor.

Confirm the current status with your counsel and the HHS rulemaking record before you plan around any HIPAA MFA requirement, because a proposed rule is not binding until it is finalized. Whatever the timing, HIPAA has no certification that proves MFA is in place. HHS states that no Security Rule standard requires an entity to certify compliance and that HHS does not endorse or recognize private certifications, so your MFA evidence will be documentation you keep for your own risk analysis and for regulators who ask. Many of the same identity controls appear in PCI DSS, CMMC, NERC CIP and Swift CSCF, so a rollout planned for those frameworks usually covers most of the access paths a HIPAA review would examine.

The CMMC phase changes reduce the near-term assessment pressure but do not remove the MFA requirement. On 13 July 2026 the Department of War suspended CMMC Phase II, which had been scheduled to start 10 November 2026 and would have required Level 2 certification for applicable contracts, and began a 60-day review by a CMMC Reform Task Force. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain. Sources disagree on the current schedule: the eCFR text of 32 CFR 170.3(e) still shows the original four-phase schedule, while the DoW CIO page dated 17 October 2026 says implementation is paused. Under IA.L2-3.5.3, a missing MFA control can cost 5 points, and a partial implementation covering only remote and privileged users can cost 3, which is too large to place on a POA&M. Confirm the current schedule with your contracting officer.

Requirement 8.4 splits MFA by the kind of access, so one rollout needs three distinct scopes. Requirement 8.4.1 covers all non-console administrative access into the cardholder data environment, 8.4.2 covers all access into it, and 8.4.3 covers remote network access from outside the entity's network that could affect the environment, including third parties and vendors. PCI DSS v4.0.1 allows MFA under 8.4.2 to be skipped for accounts that use only phishing-resistant authentication, but that exemption does not extend to 8.4.1 or 8.4.3 under PCI SSC FAQ 1596. Plan separate enforcement for vendor remote access and administrators, and confirm the approach with your Qualified Security Assessor before you finalize the design.