Essential Eight MF-ML1.2 Multi-factor authentication for third-party services handling sensitive data
What it says
Multi-factor authentication is used to authenticate users to third-party online services that process, store or communicate their organisation's sensitive data.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse multi-factor authentication for third-party services with sensitive data to prevent unauthorised access.
Multi-factor authentication (MFA) is like having two locks on your door instead of one. It's important because it makes it much harder for someone to break into your online services and see sensitive information, like your financial records. Without MFA, a hacker could easily steal your password and get full access.
Free. Save your status, tasks and notes.
Why it matters
Without MFA on third-party services, stolen credentials can allow unauthorised access and exfiltration of sensitive organisational data.
How to implement
IT team should enable multi-factor authentication for all third-party services that handle sensitive data to prevent unauthorised access.
System administrator should regularly update the authentication methods to include robust options, such as a one-time password (OTP) sent to a separate device.
Security officer should conduct training for staff about how and why to use multi-factor authentication, including the importance of safeguarding their additional authentication device.
Security officer should review and assess third-party vendors to ensure their services have multi-factor authentication capabilities enabled by default.
Keep it running
Confirm MFA is enforced for all third-party services handling sensitive data, and review new integrations/vendors to prevent MFA bypass.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Have you enabled multi-factor authentication for all third-party services used by the organisation?
Look at
Check the configuration settings in the user account management system or security policy documents.
Good evidence
Yes, multi-factor authentication is enabled for all third-party services that handle our sensitive data, and here is the policy document that outlines this process.
- Check 2 of 2What an auditor asks for
Ask for
How do you verify that your staff are properly using multi-factor authentication?
Look at
Look at the training records or system logs showing successful multi-factor authentication logins.
Good evidence
We regularly train staff on MFA best practices, and our logs show successful use of multi-factor authentication across all services.
Mappings
Closest match in ASD Information Security Manual: ISM-1679, Multi-factor authentication for third-party services handling sensitive data, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.5.
E8-MF-ML1.2 requires MFA for authenticating users to third-party services handling sensitive data. ISO/IEC 27001:2022 Annex A 8.5 requires implementing secure authentication procedures commensurate with access restrictions and access control policy, which can include MFA. E8-MF-ML1.2 is a specific prescriptive instance within the broader authentication expectations of Annex A 8.5.
ASD Information Security Manual: 7 mappings
This control is equivalent to ISM-1679.
ISM-1679 requires multi-factor authentication for human users accessing third-party online services that process, store or communicate the organisation's sensitive data. E8-MF-ML1.2 states the same requirement for users authenticating to third-party online services handling the organisation's sensitive data. The scope and intent align closely enough that implementing E8-MF-ML1.2 would largely satisfy ISM-1679 and vice versa.
This control partially meets ISM-1401.
E8-MF-ML1.2 requires multi-factor authentication (MFA) for user access to third-party online services handling the organisation's sensitive data. ISM-1401 defines what constitutes MFA and acceptable factor combinations, applying across contexts. E8-MF-ML1.2 is a specific use case of the broader MFA requirement described in ISM-1401.
- ISM-1504Multi-factor authentication for human users of sensitive data online servicesPartially overlaps
This control partially overlaps ISM-1504.
ISM-1504 requires MFA for human users of the organisation's own online services that handle the organisation's sensitive data. E8-MF-ML1.2 overlaps by applying the same MFA requirement to third-party online services that process, store or communicate the organisation's sensitive data. They align on protecting access to sensitive-data services with MFA, but differ on service ownership (internal vs third-party).
- ISM-1680Multi-factor authentication for human users of third-party services holding non-sensitive dataPartially overlaps
This control partially overlaps ISM-1680.
E8-MF-ML1.2 requires MFA for third-party online services processing, storing or communicating the organisation's sensitive data. ISM-1680 also requires MFA for third-party online services but is scoped to the organisation's non-sensitive data. They align on the control mechanism (MFA for third-party services) but differ materially on the data sensitivity threshold, therefore impacting the risk posture and minimum expectations.
This control partially overlaps ISM-1681.
ISM-1681 mandates MFA for customers accessing the organisation's online customer services that handle sensitive customer data. E8-MF-ML1.2 mandates MFA for users accessing third-party online services that handle the organisation's sensitive data. They overlap on applying MFA to online services handling sensitive information, but differ on both the service ownership (organisation-run vs third-party) and the data focus (customer data vs organisation data).
- ISM-1893Multi-factor authentication for third-party services holding sensitive customer dataPartially overlaps
This control partially overlaps ISM-1893.
E8-MF-ML1.2 requires MFA for third-party online services handling sensitive organisational data. ISM-1893 stipulates MFA for third-party online customer services handling sensitive customer data, which is a specific subset of sensitive data and service types. ISM-1893 is narrower on service category (customer services) and data type (customer data), while E8-MF-ML1.2 is broader across third-party services handling any organisational sensitive data.
This control depends on ISM-1919.
E8-MF-ML1.2 requires MFA for authentication to third-party services handling sensitive data. ISM-1919 supports this by disabling non-MFA authentication protocols for online services, reducing bypass paths. E8-MF-ML1.2 sets the MFA requirement, while ISM-1919 ensures its enforcement.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-13.4Enforce phishing-resistant MFA for all user authentication, including from untrusted locationsPartially overlaps
This control partially overlaps IT.PRO-13.4.
IT.PRO-13.4 requires phishing-resistant MFA for users authenticating to systems, including from untrusted, external or high-risk locations; E8-MF-ML1.2 requires MFA for users of third-party online services handling the organisation's sensitive data, a narrower case without phishing resistance.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.