Even without Active Directory,
you can meet the NIST SP 800-171
multi-factor authentication requirement
A business partner told you, "Please comply with the US security standard."
But all your company has is PCs in a workgroup. No server, and no IT staff.
This is the answer for companies that got stuck right there
We learned about this standard from our customers
It all started with a single inquiry.
The request did not come from the defense sector. It came from a large, listed company they deal with every day. We were told that the company was contacting its entire supply chain, asking them to meet this standard.
What is more, the requirement was neither ISO 27001 nor a Japanese security standard. The standard specified by name was the US NIST SP 800-171.
The same kind of inquiry kept coming after that. We learned about this standard from our customers.
A US government standard that has become a de facto "condition of doing business"
NIST SP 800-171 is a security standard set by the US government (NIST = National Institute of Standards and Technology). It defines how organizations outside the government must protect important information handled by the government when they hold it.
Because this standard applies to suppliers of the US Department of Defense (the Pentagon), it has spread worldwide as the de facto "defense industry standard." And Japan's Acquisition, Technology & Logistics Agency (ATLA) adopted it at the same level as the "Defense Industry Cybersecurity Standard" (established in March 2022 and applied to contracts from fiscal year 2023).
🇺🇸 NIST SP 800-171
A standard set by the US government. It applies to suppliers of the US Department of Defense and has spread worldwide as the de facto defense industry standard.
🇯🇵 Defense Industry Cybersecurity Standard
The above, adopted at the same level by Japan's Acquisition, Technology & Logistics Agency (ATLA). Established in March 2022 and applied to contracts from fiscal year 2023.
The Japanese standard is not a "certification" granted by a third party; it is a condition attached to contracts (special provisions). And its requirements flow down to subcontractors and sub-subcontractors.
That is why companies with no connection to the Ministry of Defense or to the US one day receive a message saying "Please comply with the US standard." "If you cannot comply, we will review our business with you": this is the most common topic among the inquiries we receive today.
Requirement 03.05.03 also covers the PCs in your office
Multi-factor authentication is set out in Requirement 03.05.03 (3.5.3 in Rev.2). The original text of the latest version (Rev.3) reads as follows.
There is no qualification such as "when accessed remotely." In Rev.3, the distinction between local access and network access itself was removed. The previous version, Rev.2, read as follows.
So even in Rev.2, local access to privileged accounts (administrator IDs) was covered. And in Rev.3, access by all users is covered. Whichever version you look at, logins to the PCs in your office are not excluded.
This is often overlooked. Many people assume that "multi-factor authentication is about remote access," but the original text clearly says local access. The everyday Windows login you do while sitting in front of the PC is covered.
In other words, being workgroup PCs inside your office does not exclude them from the requirement.
"We know we are covered, but there is nothing we can install"
Most multi-factor authentication systems are built on the assumption that Active Directory or Microsoft Entra ID is in place. In reality, however, the situation at small and medium-sized businesses is far more likely to look like this.
- No Active Directory. Each PC is on its own in a workgroup
- No budget for a dedicated server, and nowhere to put one
- No IT staff. An employee who knows about PCs looks after them on the side
- We got a quote for several million yen, and the discussion stopped there
- We cannot continue the business relationship unless we comply, and the deadline is approaching
The words of a customer who consulted us capture this situation well.
Multi-factor authentication for Windows login, from a single PC
applippli-key uses neither Active Directory nor a dedicated server. Just install it on the PC and register the smartphone you already have.
Because it combines two factors of different types, it is two-step authentication and, at the same time, two-factor authentication (multi-factor authentication, MFA). This is exactly the form Requirement 03.05.03 calls for.
No AD required
It works the same way in a domain or a workgroup. There is no need to change your network configuration.
From a single PC
Device licenses. There is no minimum number of devices and no minimum contract period. You can start with just the PCs in scope.
As little as 5 minutes
Just follow the setup screens. No specialist knowledge is needed. You can use it the same day.
No extra hardware
It uses the smartphones you already have. There is no cost of buying a hardware key for every person.
What is more, everyday login changes from typing a password to a one-touch action on your smartphone. Adding security does not slow down your work. See how login becomes easier (Japanese) →
The same product also covers storing and submitting logs
NIST SP 800-171 requires more than multi-factor authentication. It also requires audit and accountability (the 03.03 family of requirements; the 3.3 family in Rev.2): recording who did what and when, and being able to retrieve those records when needed.
No limit on retention period
Because there is no retention period setting, you can keep even 10 years of logs. You can answer when asked, "How many years of logs can you keep?"
Aggregate by period
You can extract and review only the period requested in an audit.
CSV export
Use it as is for forensic investigations or for submitting audit materials.
Instant alerts to the user
When suspicious access is detected, an alert reaches the LINE account that the person who uses that PC registered themselves, in about 1 second. The IP address is blocked automatically.
There is no need to buy two separate products. One product addresses both the multi-factor authentication and the logging requirements.
This is not an "NIST SP 800-171 certified product"
Let us be clear. NIST SP 800-171 is a standard for an organization's management practices. There is no scheme under which a product obtains certification. No matter the vendor, "buy this product and you comply with 800-171" does not hold true.
It is your organization that meets the requirements; what we provide is the means. applippli-key can be used as a means of implementing Requirement 03.05.03 (multi-factor authentication), one of the many requirements. It also contributes to the 03.03 family of requirements (audit and accountability).
How to proceed
Define the scope
Identify the PCs that handle information to be protected. Starting with just those is fine.
Install and try
Install it on one PC and try it out. It takes as little as 5 minutes.
Expand
If there are no problems, add more PCs. There is no limit on the number of PCs.
If you have a compliance deadline, please let us know the date. We will propose a way to proceed that meets it.
Frequently asked questions
We have collected the questions we are most often asked about complying with NIST SP 800-171. Is it certified? Can we meet the requirement without Active Directory? Isn't Requirement 03.05.03 only about remote access? Six questions and answers are on our FAQ page.
The one thing you need now to keep doing business.
Even without Active Directory or IT staff, you can start with a single PC.
I want to know the cost first
- Monthly, annual and initial fees are listed as they are
- First month free. No minimum contract period
I want to consult about compliance
- Feel free to consult us with the requirements document from your business partner as it is
- If you have a deadline, please let us know