NIST 800-171 Controls · Identification & Authentication

IA.2.079 — Employ replay-resistant authentication mechanisms

CMMC Level 2SPRS if unmet: -3HIGH priority~5h to implement

Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.

What IA.2.079 means in plain English

Some attacks work by intercepting your login credentials and "replaying" them later to gain access. Replay-resistant authentication prevents this by making each login attempt unique — so a captured credential is useless. In practice, using modern protocols like Kerberos (built into Windows domain login), TLS 1.2/1.3 (used automatically by HTTPS websites), and time-based one-time passwords (TOTP, which is what Microsoft Authenticator generates) all qualify. If your team is on Microsoft 365 with MFA already enforced, you likely satisfy this control already — the key is documenting it.

The assessment question

“Do all network authentication mechanisms use replay-resistant protocols (such as Kerberos, TLS 1.2+, or TOTP-based MFA) — and has this been verified and documented?”

How to implement IA.2.079

Verify Windows domain authentication uses Kerberos by checking Active Directory settings; if using a workgroup, configure Windows Hello for Business which uses asymmetric cryptography (inherently replay-resistant).
Confirm all remote access (VPN, RDP) uses TLS 1.2 or 1.3 by checking server/VPN configuration and disabling TLS 1.0 and 1.1.
Ensure MFA tokens used are time-based (TOTP) or challenge-based — Microsoft Authenticator satisfies this by default.
Disable NTLM authentication in Group Policy where feasible and enforce Kerberos for internal domain authentication.
Document the authentication protocols in use as part of your System Security Plan (SSP).

Evidence your assessor will ask for

Group Policy configuration showing NTLM restricted or Kerberos enforced
TLS configuration screenshot showing only TLS 1.2 and 1.3 enabled on all servers and VPN endpoints
System Security Plan section documenting replay-resistant mechanisms in use
Screenshot of MFA method configuration confirming TOTP or challenge-response tokens

Does AI prompt monitoring help with this control? Honestly, no.

IA.2.079 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →

More Identification & Authentication controls

IA.1.076

Identify system users, processes, and devices

IA.1.077

Authenticate identities of users, processes, and devices

IA.2.078

Use multifactor authentication for local and network access

IA.2.080

Prevent reuse of identifiers

IA.2.081

Disable identifiers after defined period of inactivity

IA.2.082

Enforce minimum password complexity and change of characters

Score yourself against all 110 controls

The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.

Start the free assessment $499 AI risk assessment