Essential Eight MF-ML1.1 Require multi-factor authentication for sensitive online services
What it says
Multi-factor authentication is used to authenticate users to their organisation's online services that process, store or communicate their organisation's sensitive data.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure users use multiple ways to verify their identity when accessing sensitive company data online.
This control means using more than just a password to access sensitive online systems, like those that store company data. It's important because if someone steals a password, they could access valuable information. Multi-factor authentication makes it much harder for unauthorised people to get in.
Free. Save your status, tasks and notes.
Why it matters
Without MFA, a compromised password can allow unauthorised access to sensitive online services, leading to exposure of sensitive data and potential financial loss.
How to implement
IT team should ensure that all sensitive online services require multi-factor authentication by configuring settings that require a second form of identification like a text message code.
System administrator should regularly update the authentication methods to include the most secure options available by checking for updates from service providers and applying them.
Security officer should conduct training sessions for staff, explaining how to use multi-factor authentication, by organising workshops or sending newsletters with step-by-step guides.
IT manager should review third-party online services to verify they offer multi-factor authentication by contacting the service providers and implementing MFA where available.
Keep it running
Enforce MFA on all online services handling sensitive data, require phishing-resistant methods where possible, and review enrolment/coverage regularly (including admins and remote access).
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
What measures are in place to ensure multi-factor authentication is used for accessing sensitive data?
Look at
Examine login logs and security settings for services to verify that they require multiple authentication methods.
Good evidence
Login systems show records of using a password and a one-time code received via SMS or authenticator app.
- Check 2 of 2What an auditor asks for
Ask for
How does the organisation ensure that third-party services used meet the multi-factor authentication requirement?
Look at
Check contracts and service agreements with third-party providers for clauses on authentication standards.
Good evidence
Documentation or agreements confirming that third-party services implement and enforce multi-factor authentication.
Mappings
Closest match in ASD Information Security Manual: ISM-1504, Multi-factor authentication for human users of sensitive data online services, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.5.
E8-MF-ML1.1 requires MFA for authentication to sensitive online services. ISO/IEC 27001:2022 Annex A 8.5 relates by requiring secure authentication technologies and procedures based on access restrictions, under which MFA for higher-risk/sensitive access is a common and appropriate control. Annex A 8.5 is broader and less prescriptive (covering all authentication methods and procedures), while E8-MF-ML1.1 is a specific requirement mandating MFA for a defined scope of services and data.
ASD Information Security Manual: 11 mappings
This control is equivalent to ISM-1504.
ISM-1504 requires multi-factor authentication to authenticate human users to the organisation's online services that process, store or communicate the organisation's sensitive data. E8-MF-ML1.1 states the same requirement for MFA on the organisation's online services handling the organisation's sensitive data. Both controls match in subject (human users), mechanism (MFA), and scope (organisation online services handling sensitive data).
This control is broader than ISM-1892.
E8-MF-ML1.1 requires MFA for the organisation's online services that process, store or communicate sensitive data. ISM-1892 relates as a specific application of MFA to the organisation's online customer services handling sensitive customer data, which is a subset of the broader 'sensitive data online services' population. E8-MF-ML1.1 therefore encompasses ISM-1892, while ISM-1892 does not address other sensitive online services outside customer services.
This control partially meets ISM-1546.
ISM-1546 requires users to be authenticated before they are granted access. ASD Essential Eight E8-MF-ML1.1 enhances this by specifying multi-factor authentication for users accessing sensitive data online services, which is one way to meet authentication-before-access for a subset of services. E8-MF-ML1.1 focuses on sensitive online services and mandates MFA.
This control partially meets ISM-1682.
E8-MF-ML1.1 requires MFA for access to online services that handle the organisation's sensitive data. ISM-1682 requires that MFA used for authenticating users of systems is phishing-resistant, which is a stronger and broader quality requirement that can apply beyond online services and beyond just sensitive-data contexts. Implementing ISM-1682 for relevant online services would satisfy and exceed E8-MF-ML1.1, but E8-MF-ML1.1 alone does not ensure phishing-resistant MFA.
This control partially overlaps ISM-1505.
E8-MF-ML1.1 requires multi-factor authentication (MFA) for users accessing the organisation's online services that process, store or communicate sensitive data. ISM-1505 relates by requiring MFA for users of data repositories, which are a common class of system used to store or provide access to sensitive data. The overlap is strongest where those repositories are delivered as online services, but ISM-1505 can also apply to internal/non-online repositories while E8-MF-ML1.1 is specifically scoped to online services handling sensitive data.
- ISM-1679Multi-factor authentication for third-party services handling sensitive dataPartially overlaps
This control partially overlaps ISM-1679.
E8-MF-ML1.1 requires MFA for users authenticating to the organisation's online services that handle sensitive organisational data. ISM-1679 relates by requiring MFA for users authenticating to third-party online services that process, store or communicate the organisation's sensitive data. The overlap is MFA for access to online services handling sensitive organisational data, but ISM-1679 focuses on third-party services whereas E8-MF-ML1.1 is framed around the organisation's own online services.
This control partially overlaps ISM-1681.
ISM-1681 requires MFA for customers accessing online customer services that handle sensitive customer data. E8-MF-ML1.1 requires MFA for users accessing the organisation's online services that handle the organisation's sensitive data, which may include employees and may not be limited to customer services. They overlap on the use of MFA for online services handling sensitive information, but differ in scope (customers/customer data vs users/organisation data).
- ISM-1893Multi-factor authentication for third-party services holding sensitive customer dataPartially overlaps
This control partially overlaps ISM-1893.
E8-MF-ML1.1 requires MFA for users of the organisation's online services that handle sensitive data. ISM-1893 overlaps by requiring MFA for third-party online customer services that process, store, or communicate the organisation's sensitive customer data, which is a specific subset of sensitive online services and explicitly focuses on third-party customer platforms. E8-MF-ML1.1 covers both first-party and third-party online services handling sensitive data, while ISM-1893 is limited to third-party customer services and sensitive customer data.
This control supports ISM-1401.
E8-MF-ML1.1 requires MFA to authenticate users to sensitive online services. ISM-1401 supports this by defining acceptable MFA factor constructions (e.g., something you have + something you know/are), which guides how E8-MF-ML1.1 should be implemented securely. ISM-1401 is a design/strength requirement for MFA, whereas E8-MF-ML1.1 is a deployment requirement for particular services and data sensitivity.
This control supports ISM-1872.
E8-MF-ML1.1 requires MFA for users accessing the organisation's online services that handle sensitive organisational data. ISM-1872 strengthens this by requiring the MFA used for authenticating users of online services to be phishing-resistant, reducing the likelihood of credential theft bypassing MFA. ISM-1872 is a quality/strength requirement for MFA rather than a baseline requirement to deploy MFA everywhere in scope.
This control depends on ISM-1919.
ISM-1919 disables all non-MFA-capable protocols to prevent circumvention when MFA is used. E8-MF-ML1.1 requires MFA for accessing sensitive online services, aligning with ISM-1919 in securing entry points by eliminating weaker authentication methods.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-13.4Enforce phishing-resistant MFA for all user authentication, including from untrusted locationsPartially overlaps
This control partially overlaps IT.PRO-13.4.
IT.PRO-13.4 requires phishing-resistant MFA for users authenticating to systems, including from untrusted, external or high-risk locations; E8-MF-ML1.1 requires MFA for users of the organisation's online services handling sensitive data, a narrower case without phishing resistance.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.