Essential Eight MF-ML2.2 Use multi-factor authentication for unprivileged user access
What it says
Multi-factor authentication is used to authenticate unprivileged users of systems.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishRequire additional authentication methods for regular system users.
This control is about requiring more than just a password to access your systems. It's like adding an extra lock to your door. It makes it much harder for someone to break in and steal valuable information, even if they guess your password.
Free. Save your status, tasks and notes.
Why it matters
Without MFA for unprivileged users, stolen passwords enable unauthorised access, increasing the risk of data theft and serving as a foothold for lateral movement.
How to implement
The IT team should enable two-factor authentication for all user accounts.
This means setting up a mobile app that generates codes or sending codes via text message each time someone logs in.
System administrators need to ensure that the software used supports multi-factor authentication.
Begin by checking system settings and enabling the multi-factor option provided.
The security officer should educate staff about the importance of using multi-factor authentication.
Conduct workshops to show how to set up and use the authentication methods.
IT staff should regularly verify that the multi-factor authentication system is working correctly.
This involves simulating login attempts and making sure the second step is always prompted.
System administrators should configure alerts for failed multi-factor authentication attempts.
Set up the system to notify administrators of suspicious activity.
Keep it running
Regularly review user enrolment and exclusions to maintain full MFA coverage for unprivileged users, and assess MFA method strength (e.g. phishing-resistant) as threats evolve.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How are users authenticated when accessing the system?
Look at
Check for records of multi-factor authentication usage in the access logs.
Good evidence
Logs show that users are consistently using two methods to authenticate, like a password plus a code from their phone.
- Check 2 of 2What an auditor asks for
Ask for
Are all sensitive data systems covered by multi-factor authentication?
Look at
Review the list of critical systems and ensure that multi-factor authentication is enabled for each.
Good evidence
A documented list shows all key systems with both password and secondary checks in place.
Mappings
Closest match in ASD Information Security Manual: ISM-0974, Multi-factor authentication for unprivileged human users of systems, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.5.
E8-MF-ML2.2 specifically requires MFA for unprivileged users accessing systems. ISO/IEC 27001:2022 Annex A 8.5 requires secure authentication technologies and procedures based on access restrictions and access control policy, which can include MFA but is not limited to it. E8-MF-ML2.2 is therefore a specific implementation example within the broader authentication control in Annex A 8.5.
ASD Information Security Manual: 7 mappings
This control is equivalent to ISM-0974.
E8-MF-ML2.2 requires multi-factor authentication to authenticate unprivileged users of systems. ISM-0974 states the same requirement: MFA is used to authenticate unprivileged users of systems. The scope and intent align closely, so implementing ISM-0974 would largely satisfy E8-MF-ML2.2 (and vice versa).
This control partially overlaps ISM-1505.
E8-MF-ML2.2 requires MFA to authenticate unprivileged users of systems. ISM-1505 relates by requiring MFA for users of data repositories, which is a common system category accessed by unprivileged users. ISM-1505 is narrower to a specific asset type (data repositories) and applies regardless of privilege, whereas E8-MF-ML2.2 is scoped to unprivileged users across systems more generally.
This control partially overlaps ISM-1682.
E8-MF-ML2.2 requires multi-factor authentication (MFA) to authenticate unprivileged users of systems. ISM-1682 relates by constraining the quality of that MFA, requiring it to be phishing-resistant when used to authenticate system users. ISM-1682 adds a specific strength requirement (phishing resistance) that E8-MF-ML2.2 does not explicitly mandate, while E8-MF-ML2.2 focuses on ensuring MFA is used for unprivileged access in the first place.
This control partially overlaps ISM-1854.
ISM-1854 requires human users to authenticate at multifunction devices (MFDs) before they can print, scan or copy, supporting accountability. E8-MF-ML2.2 requires multi-factor authentication (MFA) for unprivileged user access to systems, which may include MFDs treated as systems or using system authentication. ISM-1854 does not mandate MFA, while E8-MF-ML2.2 addresses authentication strength broadly, but not specifically for MFDs.
- ISM-1893Multi-factor authentication for third-party services holding sensitive customer dataPartially overlaps
This control partially overlaps ISM-1893.
ISM-1893 requires MFA for users accessing third-party online customer services that handle sensitive customer data. E8-MF-ML2.2 requires MFA for unprivileged users of systems, which can include users accessing online services but is not limited to third-party customer services or sensitive customer data. They overlap where those third-party customer services are accessed as part of system usage by unprivileged users, but each control has distinct scope constraints.
This control supports ISM-1401.
E8-MF-ML2.2 requires MFA for unprivileged users to access systems. ISM-1401 supports this by defining acceptable MFA factor combinations (something users have + know, or have unlocked by know/are), clarifying what counts as MFA for implementing E8-MF-ML2.2. ISM-1401 is definitional/technical composition guidance rather than a direct mandate about which users must use MFA.
This control supports ISM-2077.
E8-MF-ML2.2 requires MFA to authenticate unprivileged users of systems. ISM-2077 supports this by prohibiting email as an out-of-band authentication method, reducing the risk that MFA implementations used under E8-MF-ML2.2 are weakened by interceptable channels. ISM-2077 is about secure MFA design choices rather than mandating MFA coverage for unprivileged user access.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-13.4Enforce phishing-resistant MFA for all user authentication, including from untrusted locationsPartially overlaps
This control partially overlaps IT.PRO-13.4.
IT.PRO-13.4 requires phishing-resistant MFA for users authenticating to systems, including from untrusted, external or high-risk locations; E8-MF-ML2.2 requires MFA for unprivileged users of systems, covering unprivileged users without itself requiring phishing resistance.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.