# CMMC Contractors Validate MFA Elevation Controls

A CMMC Level 2 organization using Imprivata Enterprise Access Management (EAM) for multifactor authentication on privileged and non-privileged network accounts has disabled standard-user UAC elevation requests through Group Policy and is seeking a way to permit administrative elevation without losing MFA enforcement. A community response claims MFA need only be enforced once per user session, but the discussion offers no technical implementation steps or authoritative CMMC guidance to substantiate that claim.

- Contractors should validate any proposed UAC and MFA configuration against applicable CMMC assessment requirements before changing Group Policy; the discussion does not establish that session-based MFA alone is sufficient.
- Organizations evaluating or operating MFA products such as Imprivata EAM should confirm that administrative elevation can be handled in a way their assessment requirements accept.

**Jurisdictions:** federal
**Industries:** Information Technology, Defense & Military
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 08, 2026

### Vendors
- Imprivata ()

### Key Quotes
> I am wondering if it is possible to allow an admin to elevate that is logged in to a standard user account through UAC while also retaining MFA enforcement.
> — Original poster

> You only have to force MFA once per user session.
> — Community commenter

### Sources
- [CMMC Level 2 question about Imprivata EAM MFA for UAC.](https://www.reddit.com/r/CMMC/comments/1x0tb8u/cmmc_level_2_question_about_imprivata_eam_mfa_for) - reddit-cmmc