Essential Eight MF-ML1.5 Multi-factor authentication for third-party services with sensitive customer data
What it says
Multi-factor authentication is used to authenticate users to third-party online customer services that process, store or communicate their organisation's sensitive customer data.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse multi-factor authentication to secure accounts on third-party services that handle your sensitive customer data.
This control requires the use of multi-factor authentication (MFA) when accessing third-party services that manage your customer's sensitive information. This is like adding an extra lock to your digital accounts, making it much harder for unauthorised people to break in and access private data. Without this, cybercriminals can more easily steal your customers' personal information and misuse it, which could harm your business's reputation and bottom line.
Free. Save your status, tasks and notes.
Why it matters
Without MFA, unauthorised access to third-party customer services could expose sensitive customer data, harming trust and triggering regulatory penalties.
How to implement
The IT team should identify all third-party services used by the organisation that handle sensitive customer data and ensure MFA is available.
The system administrator should enable multi-factor authentication for each identified third-party service by accessing account settings and selecting the MFA option.
Security officers should educate users on how to use multi-factor authentication when logging into third-party services by providing step-by-step guides.
Organisation leaders should mandate the use of MFA for all employees accessing customer-sensitive information by updating company security policies.
Data protection officers should periodically review and update the list of third-party services to ensure all necessary services have MFA enabled.
Keep it running
Regularly verify MFA is enforced on all third-party customer service logins (incl. admin/break-glass and SSO/SAML), and review vendor reports for drift.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
What third-party services are used to store or manage sensitive customer data?
Look at
Examine the list of third-party services in use with documented evidence of MFA being enabled for each service.
Good evidence
The organisation provides a comprehensive list of third-party services with screenshots or configuration details showing MFA is enabled.
- Check 2 of 2What an auditor asks for
Ask for
How does the organisation enforce the use of MFA for these services?
Look at
Review company policy documents and employee training records related to MFA.
Good evidence
Policies explicitly require MFA for accessing sensitive data, and training records show staff have been educated about its use.
Mappings
Closest match in ASD Information Security Manual: ISM-1679, Multi-factor authentication for third-party services handling sensitive data, which asks for the same thing.
ASD Information Security Manual: 9 mappings
This control is equivalent to ISM-1679.
E8-MF-ML1.5 and ISM-1679 both require multi-factor authentication (MFA) for users accessing third-party online customer services that handle an organisation's sensitive customer data. These controls target the same threat-credential compromise or account takeover-in similar contexts, with no material difference in scope.
- ISM-1893Multi-factor authentication for third-party services holding sensitive customer dataEquivalent
This control is equivalent to ISM-1893.
E8-MF-ML1.5 and ISM-1893 both require MFA for users accessing third-party online customer services handling sensitive data. They target the same credential compromise threat within the same scope, exhibiting equivalent intent.
This control partially overlaps ISM-0974.
E8-MF-ML1.5 mandates MFA for access to third-party online customer services with sensitive data. ISM-0974 requires MFA for unprivileged users, possibly including third-party service accounts. They overlap on MFA application to limit credential compromise impacts, yet differ in user privilege scope versus service/data context.
- ISM-1504Multi-factor authentication for human users of sensitive data online servicesPartially overlaps
This control partially overlaps ISM-1504.
E8-MF-ML1.5 and ISM-1504 both require MFA for online services handling sensitive data. E8-MF-ML1.5 focuses on third-party customer services, while ISM-1504 broadly covers the organisation's online services, introducing an overlap in MFA context, differing in service ownership.
- ISM-1680Multi-factor authentication for human users of third-party services holding non-sensitive dataPartially overlaps
This control partially overlaps ISM-1680.
E8-MF-ML1.5 mandates MFA for third-party online customer services where sensitive customer data is involved. ISM-1680 mentions MFA for third-party services but limits its requirement to non-sensitive data and conditions its application. E8-MF-ML1.5 has a stronger, specific data sensitivity focus.
This control partially overlaps ISM-1681.
E8-MF-ML1.5 and ISM-1681 both apply MFA in customer-service environments handling sensitive customer data. However, ISM-1681 focuses on customers (external) authenticating, while E8-MF-ML1.5 covers users (typically organisational) accessing third-party services.
- ISM-1892Multi-factor authentication for organisation users of online customer servicesPartially overlaps
This control partially overlaps ISM-1892.
E8-MF-ML1.5 requires MFA for authentication to third-party online customer services that handle sensitive customer data. ISM-1892 requires MFA for the organisation's own online services processing the same data type, overlapping on the MFA requirement but differing in service ownership.
This control supports ISM-1919.
E8-MF-ML1.5 requires MFA for authentication to third-party online customer services. ISM-1919 mandates disabling non-MFA-capable protocols in such contexts, ensuring MFA cannot be bypassed, thus supporting the integrity of E8-MF-ML1.5's MFA requirement and preventing protocol-based downgrades.
This control depends on ISM-1401.
E8-MF-ML1.5 seeks MFA for third-party online customer services dealing with sensitive customer data. ISM-1401 defines MFA's acceptable combinations and unlocking mechanisms, essential for correct E8-MF-ML1.5 implementation. ISM-1401 lays the MFA foundation while E8-MF-ML1.5 applies it to a specific use case.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-13.4Enforce phishing-resistant MFA for all user authentication, including from untrusted locationsPartially overlaps
This control partially overlaps IT.PRO-13.4.
IT.PRO-13.4 requires phishing-resistant MFA for users authenticating to systems, including from untrusted, external or high-risk locations; E8-MF-ML1.5 requires MFA for users of third-party online customer services handling sensitive customer data, a narrower case without phishing resistance.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.