Skip to content

Two-Factor Authentication

What is Two-Factor Authentication?

An authentication method that requires two different types of verification, such as a password and a one-time code, before granting access.

Information Security

Frameworks that govern two-factor authentication

ISO 27001:2022View framework →NIST SP 800-53 Rev 5View framework →

What the standards actually require on two-factor authentication

Requirements naming two-factor authentication across 3 standards, quoted from the control text.

C5 (Germany)1 control

Control entry at every access point using an access control system whose documented rules grant least privilege authorisations, revoke unused rights after two and six months, enforce two factor authentication for areas holding customer data, escort visitors an...

C5-PS-04 · Physical site access control →
CISA Industrial Control Systems (ICS) Security Guidance1 control

Remove obscure access vectors and back doors, especially modems; limit any remaining access. Where possible implement monitoring-only access enforced by data diodes (not software-enforced read-only); prohibit persistent vendor connections;

CISA-ICS-7S-6 · Implement Secure Remote Access →
Monetary Authority of Singapore Technology Risk Management Guidelines1 control

Implement Online Financial Services Authentication + Payment Card Security per MAS TRM Chapters 12 + 13. Chapter 12 Online Financial Services Authentication - Two-Factor Authentication (2FA) for customer-facing online services + Strong Customer Authentication...

MAS-TRM-Online-Authentication-Payment-Card-Chapters-12-13-2FA-Strong-Customer-Authentication-PCI-DSS · MAS TRM Online Authentication + Payment Card + Chapters 12-13 + 2FA + Strong Customer Authentication + PCI DSS →

Questions people ask about two-factor authentication

What is Two-Factor Authentication?
An authentication method that requires two different types of verification, such as a password and a one-time code, before granting access.
Why is Two-Factor Authentication important for compliance?
Two-Factor Authentication is a key concept in Information Security. Understanding two-factor authentication helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 686 frameworks with 311K cross-framework control mappings.
Which compliance frameworks address Two-Factor Authentication?
Two-Factor Authentication appears in the requirement text of C5 (Germany), CISA Industrial Control Systems (ICS) Security Guidance, Monetary Authority of Singapore Technology Risk Management Guidelines. Across these standards we have identified 3 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Two-Factor Authentication?
Explore our compliance framework pages to see how two-factor authentication applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 686 frameworks.

See how Two-Factor Authentication applies across compliance frameworks

Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.