NIST SP 800-53 Rev. 5 · Identification and Authentication

IA-2(1) on Splunk

Privileged access without multifactor authentication — a published SPL query you can run against Splunk Enterprise / Enterprise Security, with the evidence it needs, the settings you decide, and what a result does and does not establish.

Why this matters

An administrator who can sign in with a password alone

A second step at sign-in — a code from a phone, a hardware key, a fingerprint — is the single most effective defence against stolen passwords, and it matters most for the accounts that can change everything. Organizations frequently enable it broadly but leave gaps: an emergency account, a contractor, a service that was set up before the policy existed. The gap is invisible until someone finds it.

Why this check earns its place. It looks specifically at the accounts where a stolen password does the most damage, rather than reporting a general adoption percentage that hides exactly the wrong exceptions.

What it reads: The organization's list of who holds administrative roles, compared against its record of who has a second sign-in step enrolled.
What it reports: Accounts with administrative powers that can still be accessed with a password and nothing else.

See related public disclosures on the Signals page →

ControlIA-2(1) — Multifactor Authentication to Privileged Accounts

PlatformSplunk (SPL)

SeverityCritical

ValidationLab-validated

What this finds

Privileged identity with no MFA enrolled, or observed authenticating with a single factor.

The requirement

The organization must implement multifactor authentication for access to privileged accounts.
NIST SP 800-53 Rev. 5 — IA-2(1).

NIST states the requirement without qualification for privileged accounts. What counts as privileged, which methods satisfy the requirement, and how exceptions are recorded remain organization-defined.

How this maps to the CISA performance goals

The Cross-Sector Cybersecurity Performance Goals are a voluntary baseline published by CISA — the U.S. federal agency for critical-infrastructure cybersecurity — written for organizations too small to employ security staff. This control speaks to:

3.F — Implement multifactor authentication (MFA)
The goal is multifactor authentication; the pack finds privileged access without it.

See the full coverage map, including the goals no query can answer →

Evidence this query needs

Privileged role register `privileged_role_register.csv`

Defines which roles your organisation treats as privileged, who owns each one, and how often it must be reviewed. Cloud platforms know which roles exist; only you know which ones matter and who is accountable for them.

Minimum fields: role_name, platform, privilege_classification

Three fields make the staleness and MFA checks work. The ownership fields are what make AC-6(7) answerable at all — without them that check has nothing to test against.

The query

Published as ia-2-1-privileged-mfa.splunk.spl. Reads index=identity, privileged_role_register.csv (lookup). Requires: Search access to the identity index.

Before this returns anything, index=identity has to be reaching Splunk Enterprise / Enterprise Security, and privileged_role_register.csv (lookup) has to be landed there. If not, the query reports nothing found — which looks exactly like nothing wrong. What has to be switched on first →

index=identity sourcetype=privileged:assignments
| dedup identity_id, role_name
| lookup privileged_role_register.csv role_name
    OUTPUT privilege_classification, mfa_required
| where isnotnull(privilege_classification)
| eval mfa_required=if(isnull(mfa_required) OR mfa_required="","TRUE",mfa_required)
| where mfa_required="TRUE"
| join type=left identity_id
    [ search index=identity sourcetype=directory:users
      | fields identity_id, mfa_enrolled, display_name ]
| where mfa_enrolled="false"
| table identity_id, display_name, role_name,
        privilege_classification, source_system, mfa_enrolled
| sort identity_id

Open this pack on Splunk to adjust the settings and download it →

The interactive version opens on Splunk — the platform on this page — even if your environment profile does not list it.

Settings you decide

NIST states the objective and leaves these to your organization. The interactive version of this pack applies them to the query for you.

Limit to specific accounts (optional): Paste identity names, one per line.

What this query returned when it was run

Executed against Splunk Enterprise 10.4.2 on 2026-08-07 against purpose-built test data. The software examined 3 records and returned 1 result in 0.155 seconds.

identity_id	display_name	role_name	privilege_classification	source_system	mfa_enrolled
USR-201	A Admin	Global Administrator	tier0	Active Directory (via Splunk)	false

Test data, not a real organization. It shows the query executes and returns the intended shape of result.

Running it continuously

Correlation search → notable event

Search type:      Correlation search (Enterprise Security)
Cron schedule:    0 */6 * * *   (every 6 hours)
Time range:       -24h to now
Trigger:          Number of results > 0
Alert action:     Create notable event + notify on-call
Urgency:          Critical
Security domain:  Access
Throttling:       Suppress 12h on identity_id

The one rule here that justifies paging on-call rather than queuing for the next review cycle — an unprotected privileged account is exploitable now.

What a result does not prove

Absence of MFA in one data source does not establish that no second factor exists. Registration state, enforcement policy, and observed behaviour are three different things and should be reconciled.

Validation status for this platform: Lab-validated. Executed by the maintainer in a personally controlled laboratory environment on the date shown. Table names, field names, and operator support still vary by tenant configuration, API version, connector, and add-on.

Before you act on a result

Is there a documented, current exception with a compensating control?
Does the account authenticate through a legacy protocol or excluded application?
Is MFA registered but not enforced by conditional access for this account?
Can the account be brought into scope now, or does a dependency block it?

Common questions

How do I check for privileged access without multifactor authentication in Splunk?: Run the published SPL query on this page against Splunk Enterprise / Enterprise Security. It reads index=identity, privileged_role_register.csv (lookup) and reports: Privileged identity with no MFA enrolled, or observed authenticating with a single factor.
What permissions are needed to run this Splunk query?: Search access to the identity index.
What evidence does IA-2(1) need that Splunk cannot produce?: Privileged role register (privileged_role_register.csv). Defines which roles your organisation treats as privileged, who owns each one, and how often it must be reviewed. Cloud platforms know which roles exist; only you know which ones matter and who is accountable for them. At minimum it must carry: role_name, platform, privilege_classification.
Does a result from this query mean the control has failed?: Absence of MFA in one data source does not establish that no second factor exists. Registration state, enforcement policy, and observed behaviour are three different things and should be reconciled.

Terms used on this page

NIST SP 800-53the U.S. federal catalogue of security requirements: The catalogue of security and privacy requirements published by the National Institute of Standards and Technology, a U.S. federal agency. U.S. government systems are measured against it, and many private organizations adopt it voluntarily. Each requirement has an identifier such as AC-2. Official source →
CISACybersecurity and Infrastructure Security Agency: The U.S. federal agency responsible for national critical-infrastructure cybersecurity. Its publications are works of the U.S. government and are free to use. Official source →
SPLSearch Processing Language: The language used to ask questions of data held in Splunk. A query written in it is text and can be read before it is run.
CPGCross-Sector Cybersecurity Performance Goals: A voluntary baseline of security practices published by the U.S. Cybersecurity and Infrastructure Security Agency, written specifically for organizations too small to employ security staff. It is a short, plainly written starting list rather than a full standard. Official source →
MFAmultifactor authentication: Requiring a second step at sign-in beyond the password — a code from a phone, a hardware key, a fingerprint. It is the single most effective protection against a stolen password.
lab-validatedexecuted in a controlled test environment: The check has been run, by the maintainer, against real security software loaded with purpose-built test data, and what it returned was recorded. It has not been run on any real organization's data.

Every term this project uses →