Yes. Multifactor authentication is requirement 03.05.03, one of the 13 CPCSC Level 1 requirements. PSPC’s how-to page says it is required for privileged accounts and for systems that store Specified Information, and I would plan for every account that touches those systems.
The reasoning
PSPC’s overview lists MFA as control 7 of the Level 1 set, under identification and authentication. Its how-to page words the duty as MFA for privileged accounts and for systems that store Specified Information. ITSP.10.171 and PSPC’s assessment criteria cover privileged and non-privileged accounts, which is the wider reading.
I plan for the wider reading. The criteria are what you sign against when you attest, and a gap on ordinary user accounts that can open the drawings is hard to defend. MFA is cheap to turn on and expensive to explain away.
Shops coming from CMMC are often surprised by this. The American Level 1 has no MFA requirement, so passing it on passwords alone says nothing about CPCSC Level 1.
Edge cases
Which systems are covered depends on your boundary. If Specified Information lives in an enclave file share plus email, MFA covers those logins and the admin accounts that manage them. Draw the boundary first, using the scoping page.
Shared logins are a problem. MFA tied to a shared shop-floor account doesn’t identify anyone, and requirement 03.05.01 asks for unique identification.
On method, authenticator apps work and hardware keys are the option I push. SMS is the weakest choice, and I would avoid it for admin accounts.
Evidence is simple. PSPC’s list of examples includes screenshots of MFA configuration, so a dated screenshot per system is enough to start.
Remote access deserves its own look. A VPN or remote desktop gateway that reaches the enclave is a privileged path in practice, even when the account behind it is an ordinary one. If MFA is on the Microsoft 365 sign-in but not on the VPN, the front door is locked and the side door isn’t. Fix both before you attest.
The cost of getting this wrong is mostly an attestation problem. Level 1 has no routine evidence review, and PSPC reserves the right to look, so the signature is what carries the weight. I would rather a shop delay its attestation by two weeks to turn MFA on than sign and hope.
What to do this week
- List every system that stores or can reach Specified Information, including email and remote access.
- List every privileged account on them, and then every ordinary user account.
- Turn on MFA for the admin accounts first, then everyone else.
- Capture a dated screenshot of each configuration and file it under 03.05.03.
The Level 1 page has the other 12 requirements, and CPCSC Bytes has short notes on the rest.
To check MFA coverage against your own boundary, book a scoping call.