Staff sign in to email and the online services that hold business data (office suite, accounting, practice or client software) with multi-factor authentication

Multi-factor authentication is used to authenticate users to their organisation’s online services that process, store or communicate their organisation’s sensitive data. Required at Maturity Levels One, Two and Three of the Multi-factor authentication mitigation strategy (Appendices A, B and C); ISM control ISM-1504 in ASD's Essential Eight to ISM mapping (December 2023).

evidence an assessor asks for Identity provider policy enforcing multi-factor authentication for the organisation's online services holding sensitive data; List of those online services mapped to the policy

Multi-factor authentication is used to authenticate users to third-party online services that process, store or communicate their organisation’s sensitive data. Required at Maturity Levels One, Two and Three of the Multi-factor authentication mitigation strategy (Appendices A, B and C); ISM control ISM-1679 in ASD's Essential Eight to ISM mapping (December 2023).

evidence an assessor asks for Inventory of third-party online services processing sensitive data with multi-factor authentication status; Screenshots or configuration exports of multi-factor enforcement at each service

Multi-factor authentication (where available) is used to authenticate users to third-party online services that process, store or communicate their organisation’s non-sensitive data. Required at Maturity Levels One, Two and Three of the Multi-factor authentication mitigation strategy (Appendices A, B and C); ISM control ISM-1680 in ASD's Essential Eight to ISM mapping (December 2023).

evidence an assessor asks for Inventory of third-party services holding non-sensitive data with multi-factor availability and status; Record of services where multi-factor authentication is not offered

Multi-factor authentication uses either: something users have and something users know, or something users have that is unlocked by something users know or are. Required at Maturity Levels One, Two and Three of the Multi-factor authentication mitigation strategy (Appendices A, B and C); ISM control ISM-1401 in ASD's Essential Eight to ISM mapping (December 2023).

evidence an assessor asks for Authentication policy listing permitted factor combinations; Evidence that knowledge-only or two knowledge factors are not accepted

Every form of non-console access into the CDE, not only administrative access, must be protected with MFA. Applicability: excludes system or application accounts that run automated functions, to point-of-sale terminal user accounts that are limited to a single card number per transaction, or to user accounts authenticated only with phishing-resistant factors. MFA is required separately for this access and for remote access under 8.4.3, so a user who connects remotely to the network and then into the CDE authenticates with MFA twice. It covers every kind of system component (cloud and hosted systems, on-premises applications, workstations, servers, endpoints and network security devices) and both direct network or system access and web-based access to applications. MFA may be applied at network or system/application level, not necessarily both. Objective under the customized approach: access into the CDE cannot be gained with a single authentication factor. Future-dated: treated as a best practice up to 31 March 2025 and mandatory since then.

evidence an assessor asks for Inventory of all non-console entry paths into the CDE, including web applications, with the MFA point for each; MFA or SSO conditional access policies scoped to CDE resources; Observation records of non-administrative users authenticating into the CDE; List of accounts exempted as automated or phishing-resistant, with justification

Where supported, make every enterprise or third-party application exposed externally enforce MFA. Enforcing MFA via an SSO provider or a directory service is an acceptable way to meet this Safeguard.

evidence an assessor asks for SSO or application MFA configuration for all externally exposed applications; List of external applications with MFA status and any exceptions; Authentication standard requiring MFA on every internet-facing enterprise and third-party application; SSO conditional access policy export showing MFA required for external sign-ins to each listed application; Sign-in log sample for external apps showing MFA challenge satisfied, with legacy authentication attempts blocked

Users, services, and hardware are authenticated. Control from NIST Cybersecurity Framework 2.0 framework, domain: PR - Protect.

evidence an assessor asks for Multi factor authentication coverage report; Phishing resistant authentication rollout plan; Authentication failure analytics; Workload identity authentication policy; Periodic authentication strength review

Multi-factor authentication is implemented for any individual accessing any information system, unless the Qualified Individual has approved in writing the use of reasonably equivalent or more secure access controls.

evidence an assessor asks for MFA enforcement on every information system access, including remote and administrative access; Qualified Individual's written approval of any equivalent control

Implement procedures to verify that a person or entity seeking access to ePHI is the one claimed. NIST recommends multi-factor authentication and authenticator assurance levels per SP 800-63B.

evidence an assessor asks for Authentication standard aligned to NIST SP 800-63B; MFA deployment report; Service account authentication design; Federation and SSO design

MFA required for any individual accessing the Covered Entity's information systems. Specifically required for remote access to information systems, remote access to third-party applications including cloud-based, and all privileged accounts other than service accounts that prohibit interactive login. Reasonably equivalent or more secure controls require CISO written approval and annual review.

evidence an assessor asks for MFA architecture diagram; Coverage report by user population (employees, contractors, customers, privileged); VPN and SSO MFA configuration screenshots; Cloud application MFA enforcement evidence; CISO-approved compensating controls register with annual review; Service account inventory with interactive login disabled; Phishing-resistant MFA roadmap (Second Amendment alignment)

Every form of non-console access into the CDE, not only administrative access, must be protected with MFA. Applicability: excludes system or application accounts that run automated functions, to point-of-sale terminal user accounts that are limited to a single card number per transaction, or to user accounts authenticated only with phishing-resistant factors. MFA is required separately for this access and for remote access under 8.4.3, so a user who connects remotely to the network and then into the CDE authenticates with MFA twice. It covers every kind of system component (cloud and hosted systems, on-premises applications, workstations, servers, endpoints and network security devices) and both direct network or system access and web-based access to applications. MFA may be applied at network or system/application level, not necessarily both. Objective under the customized approach: access into the CDE cannot be gained with a single authentication factor. Future-dated: treated as a best practice up to 31 March 2025 and mandatory since then.

evidence an assessor asks for Inventory of all non-console entry paths into the CDE, including web applications, with the MFA point for each; MFA or SSO conditional access policies scoped to CDE resources; Observation records of non-administrative users authenticating into the CDE; List of accounts exempted as automated or phishing-resistant, with justification

MFA must be applied to all administrative accounts on cloud services and to all user accounts on cloud services where supported by the provider.

evidence an assessor asks for Identity provider conditional access policy requiring multi-factor authentication; Cloud office suite report of two-step verification enrolment; Cloud platform report of multi-factor authentication on each account

Every form of non-console access into the CDE, not only administrative access, must be protected with MFA. Applicability: excludes system or application accounts that run automated functions, to point-of-sale terminal user accounts that are limited to a single card number per transaction, or to user accounts authenticated only with phishing-resistant factors. MFA is required separately for this access and for remote access under 8.4.3, so a user who connects remotely to the network and then into the CDE authenticates with MFA twice. It covers every kind of system component (cloud and hosted systems, on-premises applications, workstations, servers, endpoints and network security devices) and both direct network or system access and web-based access to applications. MFA may be applied at network or system/application level, not necessarily both. Objective under the customized approach: access into the CDE cannot be gained with a single authentication factor. Future-dated: treated as a best practice up to 31 March 2025 and mandatory since then.

evidence an assessor asks for Inventory of all non-console entry paths into the CDE, including web applications, with the MFA point for each; MFA or SSO conditional access policies scoped to CDE resources; Observation records of non-administrative users authenticating into the CDE; List of accounts exempted as automated or phishing-resistant, with justification

Secure authentication technologies and procedures are to be put in place, driven by the information access restrictions and the access control policy. Purpose (stated in ISO/IEC 27002:2022): ensures users and entities are securely authenticated when granted access to systems, applications and services. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 8.5.

evidence an assessor asks for Statement of Applicability entry for control A.8.5, showing inclusion or justified exclusion, implementation status and the risks it treats; An authentication standard linking required authentication strength to information classification and system criticality; MFA configuration and coverage reports for critical systems, remote access and privileged access, including conditional or risk-based rules; Log-on configuration showing warning banners, generic error messages, lockout or throttling after failed attempts and masked password entry; Authentication logs recording successful and failed attempts, with alerting on suspected brute force