Essential Eight MF-ML2.2Use multi-factor authentication for unprivileged user access
Official control statement
Multi-factor authentication is used to authenticate unprivileged users of systems.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Require additional authentication methods for regular system users.
What this means in practice
This control is about requiring more than just a password to access your systems. It's like adding an extra lock to your door. It makes it much harder for someone to break in and steal valuable information, even if they guess your password.
Framework
ASD Essential Eight
Control effect (Control Stack)
Preventative
E8 mitigation strategy
Multi-factor authentication
Classifications
N/A
Official last update
N/A
Control Stack last updated
29 Sept 2026
E8 maturity levels
ML2
Why it matters
Without MFA for unprivileged users, stolen passwords enable unauthorised access, increasing the risk of data theft and serving as a foothold for lateral movement.
Operational notes
Regularly review user enrolment and exclusions to maintain full MFA coverage for unprivileged users, and assess MFA method strength (e.g. phishing-resistant) as threats evolve.
Implementation tips
- The IT team should enable two-factor authentication for all user accounts. This means setting up a mobile app that generates codes or sending codes via text message each time someone logs in.
- System administrators need to ensure that the software used supports multi-factor authentication. Begin by checking system settings and enabling the multi-factor option provided.
- The security officer should educate staff about the importance of using multi-factor authentication. Conduct workshops to show how to set up and use the authentication methods.
- IT staff should regularly verify that the multi-factor authentication system is working correctly. This involves simulating login attempts and making sure the second step is always prompted.
- System administrators should configure alerts for failed multi-factor authentication attempts. Set up the system to notify administrators of suspicious activity.
Audit / evidence tips
- AskHow are users authenticated when accessing the system?
- Look atCheck for records of multi-factor authentication usage in the access logs
- GoodLogs show that users are consistently using two methods to authenticate, like a password plus a code from their phone
- AskAre all sensitive data systems covered by multi-factor authentication?
- Look atReview the list of critical systems and ensure that multi-factor authentication is enabled for each
- GoodA documented list shows all key systems with both password and secondary checks in place
Cross-framework mappings
How E8-MF-ML2.2 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 8.5 | E8-MF-ML2.2 specifically requires MFA for unprivileged users accessing systems | |
ASD ISM
| Control | Notes | Details |
|---|---|---|
equalEquivalent(1)expand_less | ||
| ISM-0974 | E8-MF-ML2.2 requires multi-factor authentication to authenticate unprivileged users of systems | |
sync_altPartially overlaps(4)expand_less | ||
| ISM-1505 | E8-MF-ML2.2 requires MFA to authenticate unprivileged users of systems | |
| ISM-1682 | E8-MF-ML2.2 requires multi-factor authentication (MFA) to authenticate unprivileged users of systems | |
| ISM-1854 | ISM-1854 requires human users to authenticate at multifunction devices (MFDs) before they can print, scan or copy, supporting accountability | |
| ISM-1893 | ISM-1893 requires MFA for users accessing third-party online customer services that handle sensitive customer data | |
handshakeSupports(2)expand_less | ||
| ISM-1401 | E8-MF-ML2.2 requires MFA for unprivileged users to access systems | |
| ISM-2077 | E8-MF-ML2.2 requires MFA to authenticate unprivileged users of systems | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related Essential 8 controls in Multi-factor authentication
See all Multi-factor authentication controls, or browse the full ASD Essential Eight library.