Essential Eight MF-ML2.3 Multi-factor authentication online services must be phishing-resistant
What it says
Multi-factor authentication used for authenticating users of online services is phishing-resistant.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure two-factor authentication can't be bypassed by phishing attacks.
This control is about ensuring that when people log into online services, they have to use a multi-step process to verify their identity that can't be easily tricked by phishing scams. Without this, cybercriminals might fool someone into giving away their login details, and then use that information to access sensitive business data.
Free. Save your status, tasks and notes.
Why it matters
Without phishing-resistant MFA, attackers can exploit credential phishing, leading to unauthorised access and data breaches.
How to implement
IT team should ensure multi-factor authentication (MFA) is enabled for all online services handling sensitive data by setting up systems that require a second step, like a code sent to a phone.
Security officer needs to choose an MFA method that is phishing-resistant, such as using hardware tokens or mobile apps that generate a one-time password, to ensure effective security.
System administrators should regularly test the MFA setup by simulating phishing attempts to see if the systems can be bypassed or not, ensuring robustness.
IT team should train all users on recognising phishing attempts and ensure they understand the importance of the second authentication step to avoid sharing sensitive information.
Keep it running
Deploy and test phishing-resistant MFA (FIDO2/WebAuthn or passkeys); block SMS/OTP for online services to reduce credential-phishing replay.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How does your organisation ensure that MFA is phishing-resistant for online services?
Look at
Examine the configuration settings of the MFA system and any reports of attempted phishing to assess effectiveness.
Good evidence
MFA is configured using a recognised phishing-resistant method such as hardware tokens, and regular tests confirm its effectiveness.
- Check 2 of 2What an auditor asks for
Ask for
What methods are in place to educate users about phishing threats and MFA use?
Look at
Review training materials and user outreach logs to verify training has been conducted.
Good evidence
Regular training sessions and updates are provided to users, and records show consistent participation.
Mappings
Closest match in ASD Information Security Manual: ISM-1872, Phishing-resistant multi-factor authentication for human users of online services, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.5.
E8-MF-ML2.3 requires a specific authentication outcome: MFA for online services must be phishing-resistant. ISO/IEC 27001:2022 Annex A 8.5 is broader, requiring secure authentication technologies and procedures based on access restrictions and access control policy, which can include MFA and anti-phishing measures. E8-MF-ML2.3 is a specific implementation expectation that fits within the broader secure authentication practices required by Annex A 8.5.
ASD Information Security Manual: 15 mappings
This control is equivalent to ISM-1872.
E8-MF-ML2.3 requires that MFA used for authenticating users of online services is phishing-resistant. ISM-1872 states the same requirement: MFA for users of online services must be phishing-resistant. The scope (online services), subject (users), and security property (phishing resistance) are substantively identical.
This control is broader than ISM-1682.
E8-MF-ML2.3 requires phishing-resistant multi-factor authentication (MFA) specifically for users authenticating to online services. ISM-1682 requires phishing-resistant MFA for users authenticating to systems generally, which includes online services as one system type. ISM-1682 is broader in scope (all systems), while E8-MF-ML2.3 is narrower and online-service specific, but they align on the phishing-resistance requirement.
This control partially overlaps ISM-0555.
ISM-0555 requires authentication and authorisation for all actions on an IP telephony network (e.g. registering phones, changing users/settings, accessing voicemail). E8-MF-ML2.3 enhances authentication by requiring phishing-resistant MFA for users of online services, including IP telephony administrative portals or voicemail services. ISM-0555 is comprehensive, covering authN/authZ for all telephony actions, not just MFA.
This control partially overlaps ISM-1173.
ISM-1173 mandates MFA for privileged human users of systems. E8-MF-ML2.3 requires phishing-resistant MFA for users of online services, potentially including privileged access paths when administration is online. The broader scope includes unprivileged users, while ISM-1173 is specific to privileged users of systems.
- ISM-1401Multi-factor authentication combines possession with knowledge or inherencePartially overlaps
This control partially overlaps ISM-1401.
ISM-1401 defines multi-factor authentication in terms of factor combinations that must include possession with knowledge or inherence. E8-MF-ML2.3 requires MFA for online services to be phishing-resistant, and ISM-1401 underpins that by ensuring MFA uses true multiple factors rather than weaker single-factor lookalikes. E8-MF-ML2.3 adds a quality attribute (phishing-resistance) not required by ISM-1401.
This control partially overlaps ISM-1874.
E8-MF-ML2.3 requires phishing-resistant MFA for users authenticating to online services. ISM-1874 applies the phishing-resistant MFA requirement to customers of online customer services, which is a specific subset of online services focused on customer authentication. They overlap on phishing-resistant MFA for online service authentication, but E8-MF-ML2.3 targets organisational user access while ISM-1874 targets customer-facing authentication.
- ISM-1892Multi-factor authentication for organisation users of online customer servicesPartially overlaps
This control partially overlaps ISM-1892.
ISM-1892 requires MFA for organisation users accessing online customer services that handle sensitive customer data. E8-MF-ML2.3 strengthens the MFA requirement by specifying that MFA for online services must be phishing-resistant, which would apply to the same logons where those online customer services are delivered as online services. ISM-1892 does not specify phishing-resistance, while E8-MF-ML2.3 does not limit scope to customer services or sensitive customer data.
- ISM-1894Phishing-resistant multi-factor authentication for human users of data repositoriesPartially overlaps
This control partially overlaps ISM-1894.
E8-MF-ML2.3 requires phishing-resistant MFA for authenticating users of online services. ISM-1894 requires phishing-resistant MFA for authenticating users of data repositories, which may be online services but are scoped to a particular asset type. The controls align on phishing-resistance for MFA but differ in the services/targets covered (online services generally versus data repositories specifically).
This control partially overlaps ISM-2011.
ISM-2011 requires that when a human user uses phishing-resistant MFA, all other non-phishing-resistant MFA options are disabled on that user account to remove downgrade or fallback sign-in paths. E8-MF-ML2.3 requires MFA for authenticating users of online services to be phishing-resistant, which aligns with the intent of preventing credential phishing and MFA interception. However, E8-MF-ML2.3 is primarily a strength requirement for the MFA method used, while ISM-2011 is specifically about account configuration to prevent weaker alternative MFA methods being left enabled.
- ISM-1680Multi-factor authentication for human users of third-party services holding non-sensitive dataSupports
This control supports ISM-1680.
ISM-1680 requires organisations to use multi-factor authentication (where available) for users accessing third-party online services handling non-sensitive organisational data. E8-MF-ML2.3 strengthens this by requiring that MFA used for authenticating users of online services is phishing-resistant, which would improve the effectiveness of MFA deployments used to meet ISM-1680. ISM-1680 does not specify phishing-resistance, while E8-MF-ML2.3 does not limit itself to third-party services or non-sensitive data.
- ISM-1893Multi-factor authentication for third-party services holding sensitive customer dataSupports
This control supports ISM-1893.
ISM-1893 requires MFA for users authenticating to third-party online customer services that process, store or communicate the organisation's sensitive customer data. E8-MF-ML2.3 strengthens this by requiring that MFA used for authenticating users of online services be phishing-resistant, which would improve the security of the MFA mandated by ISM-1893. ISM-1893 does not specify phishing resistance, so E8-MF-ML2.3 adds a quality requirement beyond the primary control's baseline.
This control supports ISM-1920.
E8-MF-ML2.3 requires organisations to use phishing-resistant MFA for users of online services to prevent credential interception and replay via phishing. ISM-1920 strengthens that outcome by restricting MFA self-enrolment from untrustworthy devices for online services (and other contexts), reducing the likelihood an attacker can register their own factor after phishing or device compromise. ISM-1920 does not itself define phishing-resistance, but it supports the integrity of MFA deployments that E8-MF-ML2.3 relies on.
This control supports ISM-2077.
ISM-2077 requires that email is not used as an out-of-band authentication channel. This supports E8-MF-ML2.3 because email-based verification codes and links are generally not phishing-resistant, so prohibiting email helps drive adoption of stronger MFA factors for online services. E8-MF-ML2.3 is broader in requiring phishing-resistant MFA overall, while ISM-2077 is a specific prohibition on one weak out-of-band method.
This control depends on ISM-1504.
ISM-1504 requires MFA for users authenticating to online services that process, store or communicate sensitive data. E8-MF-ML2.3 strengthens that requirement by specifying that the MFA used for online services must be phishing-resistant, which improves the effectiveness of MFA deployments. ISM-1504 does not specify the MFA modality or phishing resistance, so E8-MF-ML2.3 supports ISM-1504 by raising assurance rather than changing the fundamental requirement.
This control depends on ISM-1919.
ISM-1919 requires disabling any authentication protocols that cannot support MFA when MFA is used, to prevent bypass via legacy paths. E8-MF-ML2.3 requires phishing-resistant MFA for online services to ensure that remaining paths after non-MFA-capable protocol disablement are robust. Together, they reinforce MFA implementation by removing bypass routes and strengthening MFA.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-13.4Enforce phishing-resistant MFA for all user authentication, including from untrusted locationsPartially overlaps
This control partially overlaps IT.PRO-13.4.
IT.PRO-13.4 requires phishing-resistant MFA for users authenticating to systems, including from untrusted, external or high-risk locations; E8-MF-ML2.3 requires the MFA used by users of online services to be phishing-resistant, one specific case of that.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.