How Okta can help meet CMMC 2.0 Identity and Access Management requirements

Domain

Level 1

Level 2

How Okta can help

Access Control

(AC)

AC.L1-3.1.1 Authorized Access Control

Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

A formal access registration and initial provisioning process for employees and authorized third parties is in place for Okta to assign access rights for all user types to all systems and services, in alignment with policy and standards.

AC.L1-3.1.2 Transaction and Function Control

Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

AC.L2-3.1.3

Control CUI Flow

Control the flow of CUI in accordance with approved authorizations.

Organizational communication and data flows are mapped and enforced. Data discovery methodologies can be used to identify, classify, and track sensitive data. Sensitive data flows are governed by enterprise-defined information-control policies.

AC.L2-3.1.4

Separation of Duties

Separate the duties of individuals to reduce the risk of malevolent activity without collusion.

Okta employs the principle of least privilege and separation of duties. Authorized access is allowed for users (or processes acting on behalf of users)  assigned to tasks in accordance with organizational missions and business functions.

AC.L2-3.1.5

Least Privilege

Employ the principle of least privilege, including for specific security functions and privileged accounts.

AC.L2-3.1.6

Non-Privileged Account Use

Use non-privileged accounts or roles when accessing nonsecurity functions.

AC.L2-3.1.7

Privileged Functions

Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.

Logs are configured to capture actions taken specifically by individuals with administrative user privileges. Logs are secured and reviewed to identify and detect misused accounts. Discrepancies are investigated and remediated.

Privileged user access is established and administered on a controlled basis, and is limited to only what is required for users and services to undertake their duties. Privileged users are assigned a dedicated privileged account to be used solely for tasks requiring privileged access.

AC.L2-3.1.8

Unsuccessful Logon Attempts

Limit unsuccessful logon attempts. 

Lock-out features are enabled to restrict access after a certain amount of failed login attempts or user inactivity. The account is locked out for a specific duration or until an administrator enables the user account. The user is notified upon successful/unsuccessful logon.

AC.L2-3.1.9

Privacy & Security Notices

Provide privacy and security notices consistent with applicable CUI rules.

Personal data processing activities requiring or relying on consent are identified, and processes are in place to prevent the collection of such data without consent. Mechanisms to obtain, document, track, and manage consent are defined and implemented in accordance with applicable regulations, including withdrawal of consent.

AC.L2-3.1.10

Session Lock

Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.

Lock-out features are enabled to restrict access after a certain amount of failed login attempts or user inactivity. The account is locked out for a specific duration or until an administrator enables the user account. The user is notified upon successful/unsuccessful login.

AC.L2-3.1.11

Session Termination

Terminate (automatically) a user session after a defined condition.

AC.L2-3.1.12

Control Remote Access

Monitor and control remote access sessions.

Remote access is controlled, monitored, and allowed via an Okta-approved VPN client.

AC.L2-3.1.13

Remote Access Confidentiality

Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.

AC.L2-3.1.14

Remote Access Routing

Route remote access via managed access control points.

AC.L2-3.1.15

Privileged Remote Access

Authorize remote execution of privileged commands and remote access to security-relevant information.

AC.L2-3.1.16

Wireless Access Authorization

Authorize wireless access prior to allowing such connections.

N/A

AC.L2-3.1.17

Wireless Access Protection

Protect wireless access using authentication and encryption.

N/A

AC.L2-3.1.18

Mobile Device Connection

Control connection of mobile devices.

N/A

AC.L2-3.1.19

Encrypt CUI on Mobile

Encrypt CUI on mobile devices and mobile computing platforms. 

Okta protects organizationally classified data types at rest through security controls, including encryption and cryptographic controls, to align with security standards.

AC.L1-3.1.20

External Connections

Verify and control/limit connections to and use of external information systems.

N/A

AC.L2-3.1.21

Portable Storage Use

Limit use of portable storage devices on external systems.

N/A

AC.L1-3.1.22

Control Public Information

Control information posted or processed on publicly accessible information systems.

N/A

Identification and Authentication (IA)

IA.L1-3.5.1

Identification

Identify information system users, processes acting on behalf of users, or devices.

Secure authentication methods are used for access to systems and applications.

IA.L1-3.5.2

Authentication

Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

IA.L2-3.5.3

Multi-Factor Authentication

Use multi-factor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.

Multi-factor authentication methods are implemented so employees, administrators, and authorized third parties can access the network and information systems.

IA.L2-3.5.4

Replay-Resistant Authentication

Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.

Secure authentication methods are used for access to systems and applications.

IA.L2-3.5.5

Identifier Reuse

Prevent the reuse of identifiers for a defined period.

N/A

IA.L2-3.5.6

Identifier Handling

Disable identifiers after a defined period of inactivity.

N/A

IA.L2-3.5.7

Password Complexity

Enforce a minimum password complexity and change of characters when new passwords are created.

Password configurations are established, implemented, and enforced in alignment with industry, government, and other compliance requirements. Password management systems are interactive and ensure quality passwords.

IA.L2-3.5.8

Password Reuse

Prohibit password reuse for a specified number of generations.

IA.L2-3.5.9

Temporary Passwords

Allow temporary password use for system logins with an immediate change to a permanent password.

IA.L2-3.5.10

Cryptographically-Protected Passwords

Store and transmit only cryptographically protected passwords.

IA.L2-3.5.11

Obscure Feedback

Obscure the feedback of authentication information. 

Secure authentication methods are used for access to systems and applications.