Remote access (VPN, remote desktop) and every administrator account use multi-factor authentication

Multi-factor authentication is used to authenticate privileged users of systems. Required at Maturity Levels Two and Three of the Multi-factor authentication mitigation strategy (Appendices B and C); ISM control ISM-1173 in ASD's Essential Eight to ISM mapping (December 2023).

evidence an assessor asks for Configuration enforcing multi-factor authentication for privileged users of systems, including console and remote administration; Sample of privileged sign-in logs showing the second factor

Multi-factor authentication is used to authenticate unprivileged users of systems. Required at Maturity Levels Two and Three of the Multi-factor authentication mitigation strategy (Appendices B and C); ISM control ISM-0974 in ASD's Essential Eight to ISM mapping (December 2023).

evidence an assessor asks for Configuration enforcing multi-factor authentication for unprivileged users signing in to systems (workstations and remote access); Coverage report of users enrolled

Personnel with administrative access who reach the CDE through any non-console connection must use MFA. The guidance defines that using the same factor twice, such as two passwords, does not count as MFA. Applicability: covers every person holding administrative or elevated privileges who reach the CDE over a non-console connection, meaning logical access across a network interface rather than a direct physical connection. Objective under the customized approach: nobody can obtain administrative access into the CDE using a single factor alone.

evidence an assessor asks for MFA configuration for jump hosts, bastions, PAM and admin consoles into the CDE; List of administrative access paths into the CDE with the MFA control on each; Observation record of an administrator logging in with MFA; MFA enrolment report for all administrative accounts

MFA must be implemented for all remote access that originates outside the entity's network and could access or affect the CDE. Applicability: covers all user accounts able to access the network remotely where that access leads, or could lead, into the CDE, including staff, both users and administrators, and third parties such as vendors, suppliers, service providers and customers. Remote access to a network segment properly isolated from the CDE does not need MFA, though MFA is recommended for every remote connection into the entity's networks. It covers every kind of system component (cloud and hosted systems, on-premises applications, workstations, servers, endpoints and network security devices) and both direct and web-based access. The guidance defines MFA as presenting at least two of the three factor types from 8.3.1. Customized approach objective: a single authentication factor is never enough to gain remote access into the entity's network.

evidence an assessor asks for VPN, VDI and remote access gateway MFA configuration; Inventory of remote access methods, including vendor tools, with MFA status; Segmentation evidence for any remote access path claimed to be isolated from the CDE; Observation records of employee and third-party remote connections

Require MFA for remote network access.

evidence an assessor asks for Inventory of remote access paths, including VPN, ZTNA, RDP gateways and vendor support tools, each mapped to its MFA enforcement point; Access control standard requiring MFA on every remote network connection, including third parties, with the approver for any exception; VPN, ZTNA or remote desktop gateway configuration requiring a second factor for every remote session; Remote access logs showing MFA outcome per session, with any single-factor connections investigated

Where supported, require MFA on every account with administrative access, on every enterprise asset, whether the asset is managed on site or by a third-party provider.

evidence an assessor asks for MFA configuration for all administrative accounts, on-site and third-party managed; Report of admin accounts with MFA enrolment status; Privileged access standard requiring MFA for all administrative logons, including provider-managed assets; PAM or identity provider policy export enforcing MFA on admin roles, cloud consoles and hypervisor management; Admin logon records sampled across on-site and hosted assets showing MFA used on each

Users, services, and hardware are authenticated. Control from NIST Cybersecurity Framework 2.0 framework, domain: PR - Protect.

evidence an assessor asks for Multi factor authentication coverage report; Phishing resistant authentication rollout plan; Authentication failure analytics; Workload identity authentication policy; Periodic authentication strength review

Multi-factor authentication is implemented for any individual accessing any information system, unless the Qualified Individual has approved in writing the use of reasonably equivalent or more secure access controls.

evidence an assessor asks for MFA enforcement on every information system access, including remote and administrative access; Qualified Individual's written approval of any equivalent control

MFA required for any individual accessing the Covered Entity's information systems. Specifically required for remote access to information systems, remote access to third-party applications including cloud-based, and all privileged accounts other than service accounts that prohibit interactive login. Reasonably equivalent or more secure controls require CISO written approval and annual review.

evidence an assessor asks for MFA architecture diagram; Coverage report by user population (employees, contractors, customers, privileged); VPN and SSO MFA configuration screenshots; Cloud application MFA enforcement evidence; CISO-approved compensating controls register with annual review; Service account inventory with interactive login disabled; Phishing-resistant MFA roadmap (Second Amendment alignment)

Personnel with administrative access who reach the CDE through any non-console connection must use MFA. The guidance defines that using the same factor twice, such as two passwords, does not count as MFA. Applicability: covers every person holding administrative or elevated privileges who reach the CDE over a non-console connection, meaning logical access across a network interface rather than a direct physical connection. Objective under the customized approach: nobody can obtain administrative access into the CDE using a single factor alone.

evidence an assessor asks for MFA configuration for jump hosts, bastions, PAM and admin consoles into the CDE; List of administrative access paths into the CDE with the MFA control on each; Observation record of an administrator logging in with MFA; MFA enrolment report for all administrative accounts

MFA must be implemented for all remote access that originates outside the entity's network and could access or affect the CDE. Applicability: covers all user accounts able to access the network remotely where that access leads, or could lead, into the CDE, including staff, both users and administrators, and third parties such as vendors, suppliers, service providers and customers. Remote access to a network segment properly isolated from the CDE does not need MFA, though MFA is recommended for every remote connection into the entity's networks. It covers every kind of system component (cloud and hosted systems, on-premises applications, workstations, servers, endpoints and network security devices) and both direct and web-based access. The guidance defines MFA as presenting at least two of the three factor types from 8.3.1. Customized approach objective: a single authentication factor is never enough to gain remote access into the entity's network.

evidence an assessor asks for VPN, VDI and remote access gateway MFA configuration; Inventory of remote access methods, including vendor tools, with MFA status; Segmentation evidence for any remote access path claimed to be isolated from the CDE; Observation records of employee and third-party remote connections

Multi-factor authentication must be enabled for all administrative accounts on cloud services and where technically feasible on internal systems.

evidence an assessor asks for MFA enrolment per admin; Conditional Access policy targeting admin roles; PAM enforcement

Personnel with administrative access who reach the CDE through any non-console connection must use MFA. The guidance defines that using the same factor twice, such as two passwords, does not count as MFA. Applicability: covers every person holding administrative or elevated privileges who reach the CDE over a non-console connection, meaning logical access across a network interface rather than a direct physical connection. Objective under the customized approach: nobody can obtain administrative access into the CDE using a single factor alone.

evidence an assessor asks for MFA configuration for jump hosts, bastions, PAM and admin consoles into the CDE; List of administrative access paths into the CDE with the MFA control on each; Observation record of an administrator logging in with MFA; MFA enrolment report for all administrative accounts

MFA must be implemented for all remote access that originates outside the entity's network and could access or affect the CDE. Applicability: covers all user accounts able to access the network remotely where that access leads, or could lead, into the CDE, including staff, both users and administrators, and third parties such as vendors, suppliers, service providers and customers. Remote access to a network segment properly isolated from the CDE does not need MFA, though MFA is recommended for every remote connection into the entity's networks. It covers every kind of system component (cloud and hosted systems, on-premises applications, workstations, servers, endpoints and network security devices) and both direct and web-based access. The guidance defines MFA as presenting at least two of the three factor types from 8.3.1. Customized approach objective: a single authentication factor is never enough to gain remote access into the entity's network.

evidence an assessor asks for VPN, VDI and remote access gateway MFA configuration; Inventory of remote access methods, including vendor tools, with MFA status; Segmentation evidence for any remote access path claimed to be isolated from the CDE; Observation records of employee and third-party remote connections

Secure authentication technologies and procedures are to be put in place, driven by the information access restrictions and the access control policy. Purpose (stated in ISO/IEC 27002:2022): ensures users and entities are securely authenticated when granted access to systems, applications and services. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 8.5.

evidence an assessor asks for Statement of Applicability entry for control A.8.5, showing inclusion or justified exclusion, implementation status and the risks it treats; An authentication standard linking required authentication strength to information classification and system criticality; MFA configuration and coverage reports for critical systems, remote access and privileged access, including conditional or risk-based rules; Log-on configuration showing warning banners, generic error messages, lockout or throttling after failed attempts and masked password entry; Authentication logs recording successful and failed attempts, with alerting on suspected brute force