Why Multi-Factor Authentication (MFA) is Not Enough to Meet CMMC Requirements

As DoD and NIST update CMMC and SP 800-171 requirements, this advisory warns that multifactor authentication alone may not sufficiently protect Controlled Unclassified Information due to evolving threats like SMS-based spearphishing and MFA-bombing; it emphasizes supply-chain risk from compromised contractors and recommends augmenting MDM/MAM with Mobile Threat Defense (MTD) solutions—highlighting Zimperium zIPS—as a practical control to provide continuous on-device detection and stronger mobile security for CMMC compliance.