Multi-Factor Authentication
What is Multi-Factor Authentication?
An authentication method requiring users to present two or more distinct types of evidence to verify their identity before gaining access.
Terms that appear alongside multi-factor authentication
Each of these is named in at least one of the same controls as multi-factor authentication. The number is how many controls name both.
- authentication 120 shared controls
- access management 26 shared controls
- access control 26 shared controls
- nist 25 shared controls
- remote access 21 shared controls
- privileged access management 17 shared controls
- phishing 16 shared controls
- audit 15 shared controls
Frameworks that govern multi-factor authentication
What the standards actually require on multi-factor authentication
Requirements naming multi-factor authentication across 6 standards, quoted from the control text.
Multi-factor authentication is used to authenticate users of data repositories. Required at Maturity Level Three of the Multi-factor authentication mitigation strategy (Appendix C); ISM control ISM-1505 in ASD's Essential Eight to ISM mapping (December 2023).
acsc-essential-eight::E8-MFA-ISM-1505 · Multi-factor authentication (ISM-1505): Multi-factor authentication is used to authenticate users of data repositories →Multi-factor authentication is used to authenticate unprivileged users of systems.
ISM-0974 · Multi-factor authentication for unprivileged users →Agencies should require multi-factor authentication whenever networks and gateways are accessed.
new-zealand-information-security-manual-nzism::19.1.20.C.03 · 19.1.20.C.03 Multi-factor authentication for networks and gateways →The FI must implement multi-factor authentication for all administrative accounts on any operating system, database, application, security appliance or network device that is a critical system, and for all accounts on any system it uses to access customer info...
monetary-authority-of-singapore-technology-risk-management-guidelines::CHN.4.6 · Notice on Cyber Hygiene 4.6: multi-factor authentication for critical-system admins and internet access to customer information →Use multi-factor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.
171-IA-2 · Multi-Factor Authentication →MFA must be applied to all administrative accounts on cloud services and to all user accounts on cloud services where supported by the provider.
CE-SC.6 · Multi-Factor Authentication for Cloud Services →Questions people ask about multi-factor authentication
What is Multi-Factor Authentication?
Why is Multi-Factor Authentication important for compliance?
Which compliance frameworks address Multi-Factor Authentication?
Where can I learn more about Multi-Factor Authentication?
See how Multi-Factor Authentication applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.