IA-2(11)—Identification And Authentication (Organizational Users)

For remote access to privileged/non-privileged accounts, the purpose of requiring a device that is separate from the information system being accessed as one of the factors during multifactor authentication is to reduce the likelihood of compromising authentication credentials stored on the system. For example, adversaries deploying malicious code on organizational information systems can potentially compromise such credentials resident on the system and subsequently impersonate authorized users. Related control: AC-6.