Phishing-resistant MFA for CMMC: Windows Hello, FIDO2 or smart cards?

If your architecture, engineering, or construction firm handles CUI on defense work, your SPRS score and annual affirmation rest partly on one requirement: multifactor authentication. Phishing-resistant MFA is the strongest way to meet it, and the choice between Windows Hello for Business, FIDO2 keys, and smart cards comes down to how your staff actually sign in, from the office, the jobsite, and shared workstations.

Does CMMC require phishing-resistant MFA?

No. CMMC Level 2 requires multifactor authentication, and the requirement text does not specify phishing resistance. NIST SP 800-171 Rev 2 requirement 3.5.3 calls for MFA "for local and network access to privileged accounts and for network access to non-privileged accounts." Requirement 3.5.4 adds replay-resistant authentication for network access.

That leaves the method to the firm. An authenticator app push, a hardware token, a smart card, or a FIDO2 key can all satisfy the wording. The case for phishing-resistant methods rests on risk. A code or push approval can be relayed through a fake login page by a user who is fooled; a phishing-resistant method is built so that the relay fails.

Why does MFA carry so much weight in a CMMC score?

Because it is one of only two requirements scored with partial credit, and it cannot be deferred. Under 32 CFR 170.24, an assessment subtracts 5 points if MFA is not implemented for any users and 3 points if it is implemented only for remote and privileged users.

32 CFR 170.21 allows a plan of action and milestones only for requirements with a point value of 1, plus a narrow encryption exception. MFA does not qualify, so a gap here has to be closed before the assessment.

That still matters during the CMMC pause. The Department of War suspended Phase 2 on July 13, 2026, which stopped C3PAO certification from appearing as a condition of award. Level 2 self-assessments, SPRS scores, annual affirmations, and DFARS 252.204-7012 remain in effect, and each one depends on an accurate answer for 3.5.3.

What is phishing-resistant MFA?

Phishing-resistant MFA is authentication that cryptographically binds the login to the real site or system, so a fake login page cannot relay it. NIST's SP 800-63B-4, finalized July 31, 2025, sets out that test for federal systems and states plainly that passwords, one-time passcodes, and out-of-band methods such as push notifications are not phishing-resistant.

The same guideline requires verifiers at its AAL2 level to offer at least one phishing-resistant option, and its highest level, AAL3, requires a phishing-resistant authenticator with a non-exportable private key. SP 800-63B governs federal agency systems, not contractors, so it does not change what CMMC requires. It is still the clearest public yardstick for comparing methods.

In practice, three families meet that bar for most firms: FIDO2 security keys and passkeys, Windows Hello for Business, and certificate-based smart cards. Microsoft's built-in phishing-resistant authentication strength for Entra ID lists exactly those: Windows Hello for Business or platform credential, FIDO2 security key, and multifactor certificate-based authentication. Authenticator app push sign-in is not on that list.

How do Windows Hello, FIDO2 keys, and smart cards compare?

Each one is phishing-resistant when configured correctly. The differences are cost, user experience, and how well each one fits the way design and project staff actually work.

Windows Hello for Business

Windows Hello for Business stores a credential in the laptop's TPM chip and unlocks it with a PIN or biometric. For staff who work from one managed Windows laptop, it is the lowest-friction option, because the second factor is the device they already carry.

Its limit is that the credential lives on that one device. It does not help on a shared plotter workstation, a jobsite tablet, or a personal phone, and a lost or reimaged laptop means re-enrollment. Firms that rely on it usually pair it with a second method for recovery.

FIDO2 security keys and passkeys

FIDO2 keys are small USB or NFC devices that work across computers and browsers. They suit administrators, staff who move between workstations, and anyone who signs in from the field. Each user should have a backup key, which roughly doubles the hardware budget.

Passkeys use the same FIDO2 protocol. Some are bound to a device; others sync through a cloud account. Under SP 800-63B-4, syncable authenticators may not be used at AAL3, so firms that want the strongest assurance for administrator accounts generally choose device-bound keys.

Certificate-based smart cards

Smart cards and PIV-style certificates are the oldest phishing-resistant option and the one federal agencies use. They require a certificate authority, card readers, and a process for issuing and revoking cards. For a 30-person architecture or engineering firm, that overhead is usually hard to justify unless a client already provides the infrastructure. The DoD's own CMMC FAQ gives a hardware one-time password token or a PKI token as examples of MFA for virtual desktop access, which shows that assessors accept a range of methods.

Which accounts should move first?

Privileged and remote access accounts. Those are the accounts 32 CFR 170.24 singles out in its partial-credit rule, and they are the accounts attackers want most.

• Global and domain administrators, and any IT provider accounts with access to the CUI environment.
• Remote access to the CUI enclave, including VPN and virtual desktop gateways.
• Email for principals and project managers who send and receive controlled drawings and specifications.
• Break-glass accounts, which need their own documented process because they are usually excluded from normal sign-in policies.

What should an AEC firm on defense work do this quarter?

Confirm the 3.5.3 answer in your SPRS score is still accurate, then raise the floor for the accounts that matter most. A focused plan usually fits within one quarter.

• Inventory every sign-in path to systems that hold CUI, including legacy protocols that bypass MFA entirely.
• Move administrators to FIDO2 keys, with a registered backup key for each.
• Turn on Windows Hello for Business for staff on managed Windows laptops.
• Require a phishing-resistant authentication strength for administrator roles in Conditional Access, and block SMS and voice codes where they are still allowed.
• Update the system security plan to describe the methods in use for privileged, remote, and standard users, so the documentation matches what an assessor will test.

How does s90 help?

s90 deploys and documents MFA for architecture, engineering, and construction firms that handle CUI, from FIDO2 key rollout to Conditional Access policies and the system security plan language behind them. We keep the evidence current for annual affirmations, and our agreements commit to producing it within 24 hours of a request. If you want to check where your MFA stands against 3.5.3, we can walk through it with you.