Essential Eight MF-ML1.6 Multi-factor authentication for customer access to online services handling sensitive data
What it says
Multi-factor authentication is used to authenticate customers to online customer services that process, store or communicate sensitive customer data.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishRequire multiple forms of ID for customer logins to protect sensitive online data.
This control ensures that when customers log in to online services handling sensitive data, they use more than just a password. This makes it much harder for someone to break in and access private information if passwords are stolen.
Free. Save your status, tasks and notes.
Why it matters
Without MFA, attackers can take over customer accounts via stolen passwords, exposing sensitive customer data and damaging trust.
How to implement
IT team should require two forms of identification for customer logins.
Implement a system that requires both a password and a code sent to the user's phone.
Security officer should verify that all sensitive data services use multi-factor authentication.
Regularly review systems handling sensitive information to ensure compliance.
System administrator should configure customer accounts to use something they have, like a smartphone app or a hardware token, along with something they know, like a password.
Customer service should educate customers on how to set up and use multi-factor authentication.
Provide clear instructions and support for using mobile apps or tokens for extra security.
Keep it running
Enforce MFA for all customer logins to services handling sensitive data, support strong factors, and alert on repeated failures and new-device sign-ins.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Does the service require multi-factor authentication for customer logins?
Look at
Examine login logs or settings for evidence of two-step verification requirements.
Good evidence
All customer accounts must use a password plus another factor, such as an SMS code or app-based verification.
- Check 2 of 2What an auditor asks for
Ask for
How are customers informed and instructed about multi-factor authentication setup?
Look at
Review communication documents, such as emails or guides, sent to customers.
Good evidence
Regular, clear instructions available and communicated to all customers, guiding them through the multi-factor authentication setup.
Mappings
Closest match in ASD Information Security Manual: ISM-1681, Mandating multi-factor authentication for customer services, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.5.
E8-MF-ML1.6 requires MFA for customers authenticating to online customer services handling sensitive customer data. ISO/IEC 27001:2022 Annex A 8.5 broadly requires secure authentication technologies and procedures based on access restrictions and access control policy, and can include MFA among other mechanisms. E8-MF-ML1.6 is a specific prescriptive authentication control that fits within the broader expectations of Annex A 8.5.
ASD Information Security Manual: 9 mappings
This control is equivalent to ISM-1681.
ISM-1681 requires multi-factor authentication (MFA) to be used to authenticate customers to online customer services that process, store or communicate sensitive customer data. E8-MF-ML1.6 states the same requirement for customer access to such online services. Both controls have the same subject (customers), channel (online customer services), and trigger (sensitive customer data), so implementing one would largely satisfy the other.
This control is equivalent to ISM-1892.
E8-MF-ML1.6 requires multi-factor authentication (MFA) for customers accessing online customer services that process, store, or communicate sensitive customer data. ISM-1892 states the same requirement for an organisation's online customer services handling sensitive customer data, aligning in subject (customers), channel (online customer services) and data sensitivity scope. Implementing ISM-1892 would largely satisfy E8-MF-ML1.6 with no material scope gap.
- ISM-1504Multi-factor authentication for human users of sensitive data online servicesPartially overlaps
This control partially overlaps ISM-1504.
ISM-1504 requires MFA for users authenticating to the organisation's online services that handle sensitive data. E8-MF-ML1.6 shifts the subject from internal users to customers authenticating to online customer services handling sensitive customer data. The overlap is the MFA protection of access to sensitive-data services, but E8-MF-ML1.6 covers customer authentication (external identities) which is not explicitly in ISM-1504's user-focused requirement.
This control partially overlaps ISM-1874.
E8-MF-ML1.6 requires MFA for customers authenticating to online services handling sensitive customer data. ISM-1874 further constrains that customer MFA for online customer services must be phishing-resistant, which strengthens the same authentication scenario. E8-MF-ML1.6 mandates MFA use generally, whereas ISM-1874 focuses on the quality/type of MFA rather than simply requiring MFA everywhere it applies.
- ISM-1893Multi-factor authentication for third-party services holding sensitive customer dataPartially overlaps
This control partially overlaps ISM-1893.
E8-MF-ML1.6 requires multi-factor authentication (MFA) for customers accessing online customer services that process, store or communicate sensitive customer data. ISM-1893 similarly requires MFA but is scoped to users authenticating to third-party online customer services handling the organisation's sensitive customer data. The overlap is the MFA requirement for access to online customer services handling sensitive customer data, while the key difference is customer-vs-user focus and third-party vs (potentially) organisation-provided services.
This control partially overlaps ISM-1920.
E8-MF-ML1.6 requires customers to use MFA when authenticating to online customer services handling sensitive customer data. ISM-1920 adds an implementation safeguard for MFA enrolment by preventing self-enrolment from untrustworthy devices in the same kinds of services and data sensitivity contexts. E8-MF-ML1.6 is about requiring MFA at login, whereas ISM-1920 governs the security of the MFA enrolment process and device trust conditions.
This control supports ISM-1873.
E8-MF-ML1.6 requires MFA for customers accessing online customer services that handle sensitive customer data. ISM-1873 requires that customer MFA provides a phishing-resistant option, which improves resilience to credential phishing for those customer logins. This supports E8-MF-ML1.6 by strengthening the MFA implementation rather than changing the baseline requirement for MFA.
This control depends on ISM-1401.
ISM-1401 sets the minimum construction of MFA by requiring combinations of possession with knowledge or inherence (or possession unlocked by them). E8-MF-ML1.6 requires customers to use MFA when accessing online services that handle sensitive customer data, and ISM-1401 provides the definitional benchmark for acceptable MFA methods. The candidate is audience- and service-specific (customers), while ISM-1401 applies generally to MFA design.
This control depends on ISM-1919.
ISM-1919 ensures that when MFA is implemented, alternatives not supporting MFA are disabled, preventing circumvention. E8-MF-ML1.6 mandates MFA usage for protected access to sensitive data, which ISM-1919 hardens by removing weaker options.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-13.4Enforce phishing-resistant MFA for all user authentication, including from untrusted locationsPartially overlaps
This control partially overlaps IT.PRO-13.4.
IT.PRO-13.4 requires phishing-resistant MFA for users authenticating to systems, including from untrusted, external or high-risk locations; E8-MF-ML1.6 requires MFA for customers of online customer services handling sensitive customer data, a related case that covers customers but does not require phishing resistance.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.