Essential Eight MF-ML1.4 Use multi-factor authentication for online services handling customer data
What it says
Multi-factor authentication is used to authenticate users to their organisation's online customer services that process, store or communicate their organisation's sensitive customer data.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure users use multi-factor logins for online services with sensitive customer data.
This control is about using more than just a password to log into online services that handle sensitive customer information. It's important because relying only on passwords can make it easier for hackers to break into these systems, which could lead to your customers' private data being stolen or misused.
Free. Save your status, tasks and notes.
Why it matters
Without MFA, stolen passwords can allow unauthorised access to online customer services, exposing sensitive customer data and causing breaches and reputational damage.
How to implement
The IT team should ensure multi-factor authentication is set up for all online services handling customer data by selecting systems that support two-factor or more authentication options, such as SMS codes or authenticator apps.
System administrators need to configure user accounts to require multi-factor authentication for access to online services by enabling this feature in the system's user management settings.
Security officers should educate staff about the importance of using multi-factor authentication for securing customer data by organising training sessions and providing easy-to-understand guides.
The IT department should regularly review and update the list of third-party services to ensure they support multi-factor authentication by conducting quarterly audits of all connected applications and services.
Keep it running
Enforce MFA on all accounts for online customer services handling customer data; regularly review MFA logs and promptly investigate unusual authentication attempts.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Is multi-factor authentication enabled for all online services that handle sensitive customer data?
Look at
Examine system configuration settings or management dashboards to verify if multi-factor authentication options are enabled.
Good evidence
Multi-factor authentication is enabled in the system settings, and the setting is enforced across all user accounts accessing sensitive customer data services.
- Check 2 of 2What an auditor asks for
Ask for
How frequently is the list of online services reviewed for compliance with multi-factor authentication requirements?
Look at
Check meeting minutes or audit logs that show regular reviews of third-party services.
Good evidence
Review logs or documentation that confirm the list of third-party services is audited quarterly, with multi-factor authentication compliance checked for each.
Mappings
Closest match in ASD Information Security Manual: ISM-1892, Multi-factor authentication for organisation users of online customer services, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.5.
E8-MF-ML1.4 requires MFA for users authenticating to online customer services that handle sensitive customer data. ISO/IEC 27001:2022 Annex A 8.5 is broader, requiring secure authentication technologies and procedures based on access restrictions and policy, which may include MFA among other mechanisms. E8-MF-ML1.4 is a specific prescriptive authentication requirement within the wider authentication control framework described by Annex A 8.5.
This control partially overlaps A.5.17.
Annex A 5.17 requires controlled allocation and management of authentication information. E8-MF-ML1.4 relates by requiring MFA for users accessing services processing sensitive data, which introduces factors that need secure handling.
ASD Information Security Manual: 8 mappings
This control is equivalent to ISM-1892.
ISM-1892 requires multi-factor authentication (MFA) for human users (e.g. staff, administrators, support agents) accessing the organisation's online customer services that process, store or communicate sensitive customer data. E8-MF-ML1.4 states the same requirement for users of the organisation's online customer services handling sensitive customer data. Both controls align on the same service type (online customer services), the same protected data type (sensitive customer data), and the same authentication requirement (MFA rather than password-only).
This control partially meets ISM-1401.
E8-MF-ML1.4 requires MFA to be used for authentication to online customer services handling sensitive customer data. ISM-1401 defines what constitutes MFA (acceptable factor combinations), providing a broader control concept that can be applied across many systems and contexts. E8-MF-ML1.4 is a specific application of the ISM-1401 MFA requirement to a defined service type and data sensitivity scope.
- ISM-1504Multi-factor authentication for human users of sensitive data online servicesPartially overlaps
This control partially overlaps ISM-1504.
ISM-1504 requires MFA for users accessing the organisation's online services that process, store or communicate sensitive data. E8-MF-ML1.4 applies the same MFA requirement specifically to the organisation's online customer services handling sensitive customer data. The controls align on MFA for sensitive-data-bearing online services, but E8-MF-ML1.4 is narrower to customer services and customer data, while ISM-1504 is broader across sensitive data types and online services generally (not only customer services).
This control partially overlaps ISM-1505.
E8-MF-ML1.4 requires multi-factor authentication (MFA) for users accessing the organisation's online customer services that process, store or communicate sensitive customer data. ISM-1505 also mandates MFA, but specifically for users of data repositories, which may be part of (or adjacent to) those customer services. The overlap exists when the customer service relies on a repository holding customer data; however, ISM-1505 does not specifically target online customer services, and E8-MF-ML1.4 is not limited to repositories.
This control partially overlaps ISM-1681.
ISM-1681 requires MFA for customers authenticating to online customer services where sensitive customer data is processed, stored or communicated. E8-MF-ML1.4 requires MFA for users authenticating to the organisation's online customer services that handle sensitive customer data. They align on the system scope (online customer services) and data sensitivity, but differ on the actor (customers in ISM-1681 versus users in E8-MF-ML1.4, which could include staff and administrators).
- ISM-1893Multi-factor authentication for third-party services holding sensitive customer dataPartially overlaps
This control partially overlaps ISM-1893.
ISM-1893 requires MFA for staff authenticating to third-party online customer services that handle the organisation's sensitive customer data. E8-MF-ML1.4 requires MFA for users authenticating to the organisation's own online customer services handling sensitive customer data. They overlap on protecting access to online customer services with MFA, but differ on service ownership (third-party vs organisation-operated).
This control supports ISM-1682.
E8-MF-ML1.4 requires MFA for access to online customer services handling sensitive customer data. ISM-1682 strengthens this by requiring that the MFA used is phishing-resistant, improving assurance that the MFA implementation cannot be easily bypassed via credential theft or real-time phishing. ISM-1682 adds quality and robustness requirements to MFA that E8-MF-ML1.4 does not explicitly mandate.
This control depends on ISM-1919.
ISM-1919 mandates turning off protocols that cannot support MFA if MFA is used for service access, preventing legacy bypass. E8-MF-ML1.4 requires MFA where sensitive data is involved, aligning with ISM-1919 in enhancing security by ensuring MFA is both adopted and not bypassed.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-13.4Enforce phishing-resistant MFA for all user authentication, including from untrusted locationsPartially overlaps
This control partially overlaps IT.PRO-13.4.
IT.PRO-13.4 requires phishing-resistant MFA for users authenticating to systems, including from untrusted, external or high-risk locations; E8-MF-ML1.4 requires MFA for users of the organisation's online customer services handling sensitive customer data, a narrower case without phishing resistance.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.