The Defense Federal Acquisition Regulation Supplement (DFARS) requires government contractors to implement the mandatory controls for Controlled Unclassified Information (CUI) detailed in NIST SP 800-171, a key component of which is to implement multi-factor authentication (MFA) for accounts that access privileged data.