Essential Eight MF-ML1.3 Use multi-factor authentication for non-sensitive third-party services
What it says
Multi-factor authentication (where available) is used to authenticate users to third-party online services that process, store or communicate their organisation's non-sensitive data.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse a second form of verification for accounts on services handling non-sensitive org data.
Using multi-factor authentication (MFA) means that when you log in to an account, you need to provide two forms of identification instead of just a password. Imagine you're trying to get into a nightclub; you'll need both a password and an ID card, not just one or the other. This added step helps prevent hackers from getting into your accounts if they manage to steal your password. It's like having a deadbolt on your door instead of just a regular lock.
Free. Save your status, tasks and notes.
Why it matters
Without MFA, stolen credentials for third-party services could allow unauthorised access to accounts and non-sensitive organisational data.
How to implement
The IT team should identify all third-party online services that handle the organisation's non-sensitive data and make a list of these services.
The system administrator should check if these services support multi-factor authentication by looking at the service's security settings or contacting support.
If multi-factor authentication is available, the IT team should enable it for users by following the service provider's implementation guide.
The security officer should regularly review and update the list of third-party services to ensure new ones are evaluated for multi-factor authentication capability.
The IT support staff should educate users about the importance of multi-factor authentication and how to use it, possibly through a simple step-by-step guide or training session.
Keep it running
Regularly review third-party services for MFA availability and enforce it; re-check settings after vendor changes and user onboarding to prevent drift.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Can you show me the list of third-party services that handle non-sensitive data?
Look at
Examine the list for details about each service and their multi-factor authentication capabilities.
Good evidence
The list includes all relevant services and clearly indicates which ones have multi-factor authentication enabled.
- Check 2 of 2What an auditor asks for
Ask for
How does the organisation ensure multi-factor authentication is used where available?
Look at
Check for records or logs showing multi-factor authentication implementation or user enrolment for third-party services.
Good evidence
There are documented procedures and user lists confirming multi-factor authentication is set up for each applicable service.
Mappings
Closest match in ASD Information Security Manual: ISM-1680, Multi-factor authentication for human users of third-party services holding non-sensitive data, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.15.
Annex A 5.15 requires organisations to establish rules and procedures that control logical access to information based on security requirements. E8-MF-ML1.3 specifies one such rule: using multi-factor authentication for access to non-sensitive third-party online services where available. The Essential Eight requirement is a single authentication control, while Annex A 5.15 is broader and covers policy and procedural governance for access control across assets and access types.
This control partially meets A.8.5.
E8-MF-ML1.3 requires the use of MFA (where available) for user authentication to third-party online services handling non-sensitive organisational data. ISO/IEC 27001:2022 Annex A 8.5 requires secure authentication technologies and procedures to be implemented based on access restrictions and access control policy, which can include MFA but is not limited to it. E8-MF-ML1.3 is a specific MFA application scenario within the broader authentication control set of Annex A 8.5.
ASD Information Security Manual: 4 mappings
- ISM-1680Multi-factor authentication for human users of third-party services holding non-sensitive dataEquivalent
This control is equivalent to ISM-1680.
E8-MF-ML1.3 requires multi-factor authentication (where available) for users authenticating to third-party online services that process, store or communicate the organisation's non-sensitive data. ISM-1680 states the same requirement with the same third-party scope, the same non-sensitive data boundary, and the same "where available" condition. Implementing E8-MF-ML1.3 would therefore largely satisfy ISM-1680 (and vice versa).
This control partially overlaps ISM-1505.
ISM-1505 requires multi-factor authentication (MFA) to be used to authenticate human users of data repositories. E8-MF-ML1.3 mandates MFA for users accessing third-party online services, including SaaS-based repositories. ISM-1505 focuses on repository access regardless of hosting, while E8-MF-ML1.3 emphasizes third-party service usage.
This control supports ISM-1919.
E8-MF-ML1.3 requires multi-factor authentication (where available) for user access to third-party online services handling an organisation's non-sensitive data. ISM-1919 strengthens that outcome by requiring that, once MFA is in use for an online service, any non-MFA-capable authentication protocols are disabled to prevent MFA bypass. ISM-1919 is more about hardening the authentication implementation, whereas E8-MF-ML1.3 is about ensuring MFA is used for the specified third-party service scope.
This control depends on ISM-1401.
E8-MF-ML1.3 requires organisations to use multi-factor authentication for third-party services that process, store or communicate non-sensitive organisational data. ISM-1401 defines what constitutes MFA (acceptable factor combinations), which is a prerequisite to implementing E8-MF-ML1.3 correctly and consistently. ISM-1401 does not mandate where MFA must be applied, while E8-MF-ML1.3 sets the application scope (third-party services, non-sensitive data).
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-13.4Enforce phishing-resistant MFA for all user authentication, including from untrusted locationsPartially overlaps
This control partially overlaps IT.PRO-13.4.
IT.PRO-13.4 requires phishing-resistant MFA for users authenticating to systems, including from untrusted, external or high-risk locations; E8-MF-ML1.3 requires MFA, where available, for users of third-party online services handling non-sensitive data, a narrower case without phishing resistance.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.