Essential Eight MF-ML1.7 Multi-factor authentication combines two factors like a device and a PIN
What it says
Multi-factor authentication uses either: something users have and something users know, or something users have that is unlocked by something users know or are.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse something you have and something you know to secure access to important data.
Multi-factor authentication is like adding another lock on the door to your online accounts. Instead of relying just on a password, it requires an additional step, like a text message to your phone, making it much harder for bad actors to break in and access your sensitive information.
Free. Save your status, tasks and notes.
Why it matters
Without MFA using a device plus PIN/biometric, stolen passwords can allow account takeover, unauthorised access and data compromise.
How to implement
IT team should enable multi-factor authentication on all systems that contain sensitive data by accessing the security settings of their online service platforms and turning on this feature.
Security officer should ensure that employees understand how to use multi-factor authentication by providing a clear guide and offering a training session.
System administrator should deploy multi-factor authentication tools by integrating trusted systems such as authentication apps or security tokens.
Office manager should collect feedback from employees about any difficulties with multi-factor authentication to address usability issues promptly.
Keep it running
Maintain MFA that combines a device with a PIN/biometric; review enrolled authenticators, revoke lost devices, and prefer phishing-resistant methods.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Does the organisation use multi-factor authentication for accessing sensitive data?
Look at
Review the login settings of critical systems and ensure that multi-factor authentication options are enabled.
Good evidence
The organisation has enabled multi-factor authentication for all relevant systems, and users demonstrate knowledge of its operation.
- Check 2 of 2What an auditor asks for
Ask for
Can employees describe the multi-factor authentication process they follow?
Look at
Examine training records or attendance logs from multi-factor authentication workshops or training sessions.
Good evidence
Employees participated in training sessions on multi-factor authentication and can clearly explain the usage process.
Mappings
Closest match in ASD Information Security Manual: ISM-1401, Multi-factor authentication combines possession with knowledge or inherence, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.5.
E8-MF-ML1.7 mandates a specific secure authentication approach by defining MFA factor combinations (possession plus knowledge/biometrics). ISO/IEC 27001:2022 Annex A 8.5 requires organisations to implement secure authentication technologies and procedures based on access restrictions and access control policy, which can include MFA among other mechanisms. E8-MF-ML1.7 is narrower because it focuses specifically on MFA composition, whereas Annex A 8.5 is broader across authentication methods and procedures.
ASD Information Security Manual: 13 mappings
This control is equivalent to ISM-1401.
E8-MF-ML1.7 requires multi-factor authentication to be implemented using two factors: something users have and something users know, or something users have unlocked by something users know or are. ISM-1401 states the same permitted MFA factor combinations using effectively identical wording. Both controls align on the fundamental MFA construction rather than where or for whom MFA must be applied.
This control is broader than ISM-1560.
ISM-1560 requires that passwords used as part of multi-factor authentication (MFA) on SECRET systems are at least 8 characters long. E8-MF-ML1.7 defines acceptable MFA factor combinations (e.g. something you have plus something you know/are), where the ISM password is an example of the "something you know" factor. E8-MF-ML1.7 is broader because it is about MFA composition, while ISM-1560 is a specific password-strength requirement within MFA for a specific classification context (SECRET).
This control partially meets ISM-0974.
E8-MF-ML1.7 specifies the acceptable construction of MFA using two distinct factors or a device unlocked by knowledge/biometrics. ISM-0974 mandates MFA for unprivileged users of systems, which would typically be implemented using the factor combinations described in E8-MF-ML1.7. ISM-0974 is narrower because it focuses on applying MFA to a particular user group, not on defining factor combinations.
This control partially meets ISM-1173.
E8-MF-ML1.7 sets the requirement for what makes MFA valid by prescribing acceptable factor combinations. ISM-1173 requires MFA for privileged users of systems, and that MFA should conform to the factor model in E8-MF-ML1.7 to meet the intent of strong authentication. ISM-1173 is narrower because it applies MFA to a particular user class (privileged users) rather than defining MFA composition broadly.
- ISM-1504Multi-factor authentication for human users of sensitive data online servicesPartially meets
This control partially meets ISM-1504.
E8-MF-ML1.7 defines what constitutes acceptable multi-factor authentication by specifying valid factor combinations. ISM-1504 requires MFA to be used for users authenticating to the organisation's online services handling sensitive data, and would typically be implemented using the factor model described in E8-MF-ML1.7. ISM-1504 is an application/scope requirement (where MFA must be used), while E8-MF-ML1.7 is a construction requirement (how MFA must be formed).
This control partially meets ISM-1505.
E8-MF-ML1.7 defines MFA by requiring two factors (have+know, or have unlocked by know/are). ISM-1505 requires MFA for users of data repositories, and the MFA used would be expected to follow the factor composition described in E8-MF-ML1.7. ISM-1505 is narrower because it applies MFA to a specific asset type (data repositories) rather than defining MFA factor rules overall.
This control partially meets ISM-1546.
E8-MF-ML1.7 requires a specific form of user authentication: MFA with two factors. ISM-1546 is broader, requiring users to be authenticated before being granted access to systems and resources, without mandating MFA or factor types. E8-MF-ML1.7 is a stronger, more specific method that sits within the general authentication requirement of ISM-1546.
This control partially meets ISM-1679.
E8-MF-ML1.7 requires MFA to combine specific factor types (have+know, or have unlocked by know/are). ISM-1679 mandates using MFA for third-party online services that process, store or communicate the organisation's sensitive data, which should be implemented using the factor combinations described in E8-MF-ML1.7. ISM-1679 is narrower because it focuses on a specific service context (third-party online services) rather than defining MFA factors generally.
- ISM-1680Multi-factor authentication for human users of third-party services holding non-sensitive dataPartially meets
This control partially meets ISM-1680.
E8-MF-ML1.7 defines acceptable MFA factor combinations (have+know, or have unlocked by know/are). ISM-1680 requires MFA (where available) for third-party online services handling non-sensitive data, and any implemented MFA should still meet the factor rules in E8-MF-ML1.7 to avoid single-factor implementations. ISM-1680 is narrower because it is limited to third-party services and explicitly to non-sensitive data contexts.
This control partially meets ISM-1681.
E8-MF-ML1.7 requires MFA to use specific factor combinations (something users have plus something they know, or a device unlocked by knowledge/biometrics). ISM-1681 requires MFA for customers accessing online customer services that handle sensitive customer data, and such MFA should meet the factor requirements in E8-MF-ML1.7 to be considered true MFA. ISM-1681 is narrower because it is scoped to customer authentication for customer services rather than defining MFA generally.
- ISM-1893Multi-factor authentication for third-party services holding sensitive customer dataPartially meets
This control partially meets ISM-1893.
E8-MF-ML1.7 specifies what constitutes MFA by mandating specific factor combinations. ISM-1893 requires MFA for users authenticating to third-party online customer services that process, store or communicate sensitive customer data, which should be implemented in line with E8-MF-ML1.7's factor requirements. ISM-1893 is narrower because it targets a particular external customer-service context rather than defining MFA construction across the board.
- ISM-1872Phishing-resistant multi-factor authentication for human users of online servicesPartially overlaps
This control partially overlaps ISM-1872.
ISM-1872 requires the use of phishing-resistant multi-factor authentication for online services. E8-MF-ML1.7 defines acceptable factor combinations for MFA (e.g. something users have plus something users know/are), which supports consistent MFA design and deployment. However, E8-MF-ML1.7 does not ensure phishing resistance (e.g. it does not distinguish between phishable OTP and phishing-resistant methods), so it is supportive rather than equivalent.
This control depends on ISM-1919.
E8-MF-ML1.7 requires MFA to use two factors to strengthen authentication. ISM-1919 supports that outcome by requiring organisations to disable alternative authentication protocols that do not support MFA when MFA is in use for online services/customer services. ISM-1919 is about eliminating downgrade paths and ensuring MFA is consistently enforced, which is complementary to (but not defined by) E8-MF-ML1.7's factor-combination requirement.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-13.4Enforce phishing-resistant MFA for all user authentication, including from untrusted locationsPartially overlaps
This control partially overlaps IT.PRO-13.4.
IT.PRO-13.4 requires phishing-resistant MFA for users authenticating to systems, including from untrusted, external or high-risk locations; E8-MF-ML1.7 defines the factors MFA must combine: something users have and something they know, or something they have unlocked by something they know or are.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.