Skip to content
arrow_back
E8-MF-ML1.5
search account_circle
boltASD Essential Eight

Essential Eight MF-ML1.5Multi-factor authentication for third-party services with sensitive customer data

Official control statement

Multi-factor authentication is used to authenticate users to third-party online customer services that process, store or communicate their organisation's sensitive customer data.
boltASD Essential EightE8-MF-ML1.5

Quoted as published. Everything else on this page is written by Control Stack.

In plain English

Use multi-factor authentication to secure accounts on third-party services that handle your sensitive customer data.

ML1Essential EightMulti-factor authentication
Control Stack classificationPreventativeMulti-factor authentication
record_voice_over

What this means in practice

This control requires the use of multi-factor authentication (MFA) when accessing third-party services that manage your customer's sensitive information. This is like adding an extra lock to your digital accounts, making it much harder for unauthorised people to break in and access private data. Without this, cybercriminals can more easily steal your customers' personal information and misuse it, which could harm your business's reputation and bottom line.

Framework

ASD Essential Eight

Control effect (Control Stack)

Preventative

E8 mitigation strategy

Multi-factor authentication

Classifications

N/A

Official last update

N/A

Control Stack last updated

29 Sept 2026

E8 maturity levels

ML1

priority_high

Why it matters

Without MFA, unauthorised access to third-party customer services could expose sensitive customer data, harming trust and triggering regulatory penalties.

settings

Operational notes

Regularly verify MFA is enforced on all third-party customer service logins (incl. admin/break-glass and SSO/SAML), and review vendor reports for drift.

build

Implementation tips

  • The IT team should identify all third-party services used by the organisation that handle sensitive customer data and ensure MFA is available.
  • The system administrator should enable multi-factor authentication for each identified third-party service by accessing account settings and selecting the MFA option.
  • Security officers should educate users on how to use multi-factor authentication when logging into third-party services by providing step-by-step guides.
  • Organisation leaders should mandate the use of MFA for all employees accessing customer-sensitive information by updating company security policies.
  • Data protection officers should periodically review and update the list of third-party services to ensure all necessary services have MFA enabled.
fact_check

Audit / evidence tips

  • AskWhat third-party services are used to store or manage sensitive customer data?
  • Look atExamine the list of third-party services in use with documented evidence of MFA being enabled for each service
  • GoodThe organisation provides a comprehensive list of third-party services with screenshots or configuration details showing MFA is enabled
  • AskHow does the organisation enforce the use of MFA for these services?
  • Look atReview company policy documents and employee training records related to MFA
  • GoodPolicies explicitly require MFA for accessing sensitive data, and training records show staff have been educated about its use
link

Cross-framework mappings

How E8-MF-ML1.5 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.

ASD ISM

ControlNotesDetails
equalEquivalent(2)expand_less
ISM-1679E8-MF-ML1.5 and ISM-1679 both require multi-factor authentication (MFA) for users accessing third-party online customer services that han...
ISM-1893E8-MF-ML1.5 and ISM-1893 both require MFA for users accessing third-party online customer services handling sensitive data
sync_altPartially overlaps(5)expand_less
ISM-0974E8-MF-ML1.5 mandates MFA for access to third-party online customer services with sensitive data
ISM-1504E8-MF-ML1.5 and ISM-1504 both require MFA for online services handling sensitive data
ISM-1680E8-MF-ML1.5 mandates MFA for third-party online customer services where sensitive customer data is involved
ISM-1681E8-MF-ML1.5 and ISM-1681 both apply MFA in customer-service environments handling sensitive customer data
ISM-1892E8-MF-ML1.5 requires MFA for authentication to third-party online customer services that handle sensitive customer data
handshakeSupports(1)expand_less
ISM-1919E8-MF-ML1.5 requires MFA for authentication to third-party online customer services
extensionDepends on(1)expand_less
ISM-1401E8-MF-ML1.5 seeks MFA for third-party online customer services dealing with sensitive customer data

These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.

Related Essential 8 controls in Multi-factor authentication

E8-MF-ML1.2
Multi-factor authentication for third-party services handling sensitive data
E8-MF-ML1.3
Use multi-factor authentication for non-sensitive third-party services
E8-MF-ML1.4
Use multi-factor authentication for online services handling customer data
E8-MF-ML1.6
Multi-factor authentication for customer access to online services handling sensitive data
E8-MF-ML1.7
Multi-factor authentication combines two factors like a device and a PIN
E8-MF-ML2.1
Multi-factor authentication for privileged users of systems

See all Multi-factor authentication controls, or browse the full ASD Essential Eight library.

Mapping detail

Mapping

Direction

Controls