Why Sharetru Federal Requires Time-Based One-Time Passcodes (TOTP) and Why Email or SMS Codes Are Not Supported

A plain-language explanation of the federal requirement behind this setting

The short version. Sharetru Federal is a FedRAMP-authorized cloud service. FedRAMP does not permit emailed codes as a second authentication factor and heavily restricts text-message codes. An authenticator app is the standard, permitted method. This is not a product limitation or a vendor preference, and it is not a setting an administrator or the support team can switch off — it is a federal control requirement the platform is assessed against every year by an accredited third-party assessment organization.

WHERE THE REQUIREMENT COMES FROM

The requirement is inherited, not invented. Each layer below is bound by the one under it:

Your contract	DFARS 252.204-7012 and the CMMC Level 2 scoping and assessment requirements require a CSP that processes, stores, or transmits CUI to be FedRAMP Moderate Authorized or meet FedRAMP Moderate-equivalent security requirements, as applicable.
FedRAMP	The FedRAMP Moderate and High baselines are built directly on NIST SP 800-53 Rev 5. The relevant controls are IA-2(1) and IA-2(2) (multi-factor authentication for privileged and non-privileged accounts), IA-2(6) (requires one authentication factor to be provided by a device separate from the system being accessed; a control FedRAMP's current review procedure specifically checks), IA-2(8) (replay-resistant authentication), and IA-5 (authenticator management).
NIST SP 800-53 Rev 5	The IA-2 implementation guidance points to the NIST SP 800-63B Digital Identity Guidelines to define what actually counts as an acceptable authenticator. FedRAMP sets the required Authenticator Assurance Level at AAL2 for standard users and AAL3 for certain privileged access.
NIST SP 800-63B	Specifies which authenticators are permitted at each assurance level. This is the document that rules out email and restricts SMS.

WHAT NIST SP 800-63B ACTUALLY SAYS ABOUT EACH METHOD

Method	SP 800-63B treatment	Why
Emailed one-time code	Not permitted. Section 5.1.3 states that methods which do not prove possession of a specific device — email and VoIP are both named explicitly — SHALL NOT be used for out-of-band authentication.	An email inbox is normally opened with a password. Sending a code there gives you "something you know" twice rather than two distinct factors. Anyone who has your password likely has your inbox, so the second factor adds almost nothing.
SMS or voice one-time code	Restricted (Sections 5.1.3.3 and 5.2.10). Permitted only with a documented risk assessment, notification to users of the risk, an alternative authenticator offered, and a published plan to migrate away from it.	SIM-swap fraud, unauthorized number porting, SS7 interception, and carrier insider access all let an attacker receive your code without ever touching your phone. The code also travels across networks the cloud provider does not control or monitor.
Authenticator app (TOTP)	Permitted (Section 5.1.4, implementing RFC 6238). Paired with your password, it satisfies AAL2.	The shared secret is written to your device once at enrollment and is never transmitted again. Codes are calculated on the device, expire in roughly 30 seconds, and work with no signal. There is nothing in transit to intercept.

Section numbers above refer to SP 800-63B Rev 3, the revision most current FedRAMP authorization packages are assessed against. Rev 4 carries the same treatment forward: email remains excluded and SMS remains restricted. Separately, OMB Memorandum M-22-09 requires phishing-resistant MFA for federal agency staff, contractors, and partners accessing agency-hosted accounts and directs agencies to discontinue non-phishing-resistant methods such as SMS, OTP codes, and simple push approval for those users — so the direction of federal policy is further away from SMS and email, not back toward them.

WHY THIS MATTERS FOR YOUR OWN CMMC ASSESSMENT

If your organization is pursuing or maintaining CMMC Level 2, practice IA.L2-3.5.3 (drawn from NIST SP 800-171, requirement 3.5.3) requires multi-factor authentication. Your assessor evaluates the cloud services in your assessment scope, not just your internal systems. A cloud provider that allowed emailed codes as a second factor would put a finding on your assessment, not only on our authorization. In other words, the authenticator app requirement protects your certification as much as our authorization.

WHAT CANNOT BE CHANGED

Email or SMS codes cannot be enabled for a single user, a single tenant, or on a one-time basis.
Support cannot grant an exception. Departing from a FedRAMP baseline control requires a formal deviation request reviewed by the authorizing agency and our third-party assessor — it is not a support-tier decision.
Turning multi-factor authentication off entirely is not available under IA-2(1) and IA-2(2).
NIST SP 800-53 Rev 5, Security and Privacy Controls for Information Systems and Organizations — IA-2(1), IA-2(2), IA-2(6), IA-2(8), IA-5
NIST SP 800-63B, Digital Identity Guidelines: Authentication and Authenticator Management — Sections 5.1.3, 5.1.3.3, 5.1.4, 5.2.10
FedRAMP Moderate and High Security Control Baselines (Rev 5)
DFARS 252.204-7012(b)(2)(ii)(D), Safeguarding Covered Defense Information and Cyber Incident Reporting
NIST SP 800-171 requirement 3.5.3 / CMMC practice IA.L2-3.5.3
OMB Memorandum M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles
IETF RFC 6238, TOTP: Time-Based One-Time Password Algorithm

SETTING IT UP (ABOUT TWO MINUTES, ONCE)

Install any RFC 6238-compatible authenticator app — Microsoft Authenticator, Google Authenticator, Duo Mobile, Authy, 1Password, or Bitwarden all work. If you already use a password manager with built-in one-time codes, it will sync across your devices.
Scan the QR code shown during enrollment.
Save the backup or recovery codes somewhere safe — they are how you get back in if you lose the device.
At each sign-in, enter your password, then the six-digit code from the app.

Lost or replaced your device? Contact your organization's administrator to have your authenticator reset.

REFERENCES

NIST SP 800-53 Rev 5, Security and Privacy Controls for Information Systems and Organizations — IA-2(1), IA-2(2), IA-2(6), IA-2(8), IA-5
NIST SP 800-63B, Digital Identity Guidelines: Authentication and Authenticator Management — Sections 5.1.3, 5.1.3.3, 5.1.4, 5.2.10
FedRAMP Moderate and High Security Control Baselines (Rev 5)
DFARS 252.204-7012(b)(2)(ii)(D), Safeguarding Covered Defense Information and Cyber Incident Reporting
NIST SP 800-171 requirement 3.5.3 / CMMC practice IA.L2-3.5.3
OMB Memorandum M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles
IETF RFC 6238, TOTP: Time-Based One-Time Password Algorithm