Service Accounts, SMB, and the MFA Practice
During a Level 2 certification assessment, you are validating practice 3.5.3, multifactor authentication. All 210 employees authenticate to Windows and the VPN with smart cards. The enclave contains a backup server holding CUI, administered through a jump host that requires smart-card MFA. However, the backup application runs under three service accounts with static passwords that authenticate to the backup server over SMB; the passwords are stored in a password vault and rotated every 90 days. The OSA IT director states, 'Service accounts can't use MFA. This is a compensating control, and the server is not directly accessed by users.' A screenshot shows the service accounts are members of the local Administrators group on the backup server.
1. Determine whether 3.5.3 is met. Explain the basis for your conclusion.
Read the worked answer
Conclusion: Not met, absent evidence of MFA for the service-account network access.
- 3.5.3 requires MFA for local and network access to privileged accounts and for network access to non-privileged accounts. The service accounts authenticate over SMB to a CUI backup server; that is network access.
- The accounts are members of the local Administrators group on that server, so they are privileged. A static password, even vaulted and rotated every 90 days, is a single factor.
- 'Service accounts can't use MFA' is an assertion, not evidence. The assessor must determine whether the account is technically capable of MFA, whether it is truly non-interactive, and whether the server is in scope. It stores CUI backups, so it is a CUI asset.
- A compensating control may reduce risk, but the assessor validates the practice as written. The OSA must implement a solution that satisfies it, such as a group managed service account with restricted logon, removal of the accounts from privileged groups, or isolation that eliminates the network access, or accept a finding.
- Partial compliance is not averaged into a pass.
2. What evidence and validation steps would you require before finalizing the rating?
Read the worked answer
Evidence to request:
- Configuration export showing local Administrators membership on the backup server and the service-account properties.
- SMB share and logon-rights configuration for those accounts.
- Password-vault rotation logs and ownership records.
- Any MFA policy or authentication proxy applied to the server, with timestamps and system names.
- Firewall rules showing which hosts can reach the server over SMB.
Validation steps:
- Interview the backup administrator and a security administrator separately.
- Observe whether the accounts can be used interactively and whether MFA is enforced at logon.
- Confirm the backup server is a CUI asset and whether the service accounts can reach other CUI systems.
- Corroborate the claim with at least two independent sources.
- If the OSA asserts a technical exception, obtain a written rationale and test it rather than accepting it. Document dates, system names, and who provided each item.