Two-Factor Authentication
What is Two-Factor Authentication?
An authentication method that requires two different types of verification, such as a password and a one-time code, before granting access.
Frameworks that govern two-factor authentication
What the standards actually require on two-factor authentication
Requirements naming two-factor authentication across 5 standards, quoted from the control text.
Administrator password change. Level 1 (a and b): quality passwords enforced, and a new password different from the three previous ones. Level 2: two-factor authentication or token-based changes; Level 3 is the same.
mtcs-singapore::22.6 · Password change →Gold criterion secure_2FA (SHOULD; group Change Control, Public version-controlled source repository). Criterion text: The project's two-factor authentication (2FA) SHOULD use cryptographic mechanisms to prevent impersonation.
openssf-best-practices-badge-criteria::gold.secure_2FA · secure_2FA (Gold, SHOULD) →Apply defence in depth, stacking several security layers whose functions overlap. A small-system baseline control (Appendix K, category 6): locks, access control, unique logins, two-factor authentication, anti-malware, host and network firewalls and intrusion...
awwa-cybersecurity-guidance-for-the-water-sector-american-water-works-association::SC-16 · SC-16 Defence in depth →Control entry at every access point using an access control system whose documented rules grant least privilege authorisations, revoke unused rights after two and six months, enforce two factor authentication for areas holding customer data, escort visitors an...
C5-PS-04 · Physical site access control →Remove obscure access vectors and back doors, especially modems; limit any remaining access. Where possible implement monitoring-only access enforced by data diodes (not software-enforced read-only); prohibit persistent vendor connections;
CISA-ICS-7S-6 · Implement Secure Remote Access →Questions people ask about two-factor authentication
What is Two-Factor Authentication?
Why is Two-Factor Authentication important for compliance?
Which compliance frameworks address Two-Factor Authentication?
Where can I learn more about Two-Factor Authentication?
See how Two-Factor Authentication applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.