Skip to content
Multi-factor authentication
Essential EightE8-MF-ML2.5

Essential Eight MF-ML2.5 Multi-factor authentication used for system access is phishing-resistant

What it says

Multi-factor authentication used for authenticating users of systems is phishing-resistant.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Ensure system login methods resist phishing attacks using multiple authentication factors.

This control ensures that logging into important systems is more secure by using two or more forms of identification, such as a password and a unique code from an app. This extra step prevents criminals from accessing sensitive information, even if they manage to steal someone's password.

Why it matters

Without phishing-resistant MFA, attackers can hijack sessions via phishing and bypass OTP/push prompts, gaining unauthorised system access and data exposure.

How to implement

  1. Security officer should assess which systems hold or access sensitive information and require multi-factor authentication (MFA) for logging in.

  2. IT team should ensure all user accounts are enrolled in MFA by integrating an app that provides one-time codes alongside a password.

  3. System administrator should configure systems to send alerts to users when their account has a new device added for authentication, to catch potential breaches early.

  4. IT team should regularly update and test the MFA system to make sure it's working correctly and providing effective security against newer phishing methods.

  5. Security officer should offer training sessions for employees to recognise phishing attempts and understand the importance of MFA.

Keep it running

Use phishing-resistant MFA (FIDO2/WebAuthn passkeys or certificate-based). Disable SMS/OTP where possible and monitor for MFA fatigue and suspicious prompts.

Evidence and audit

  1. Check 1 of 2What an auditor asks for

    Ask for

    Are all users of sensitive systems using multi-factor authentication?

    Look at

    Review user account settings and activity logs that show MFA is enabled and used.

    Good evidence

    The documentation should show MFA is enabled for all users and logs demonstrate it's being consistently utilised.

  2. Check 2 of 2What an auditor asks for

    Ask for

    How is phishing resistance ensured in the MFA method?

    Look at

    Examine the authentication system's design and settings to ensure they use factors that cannot be easily replicated by outsiders.

    Good evidence

    The organisation uses a trusted MFA solution which is resistant to phishing, such as apps generating one-time passwords.

Mappings

Closest match in ASD Information Security Manual: ISM-1682, Phishing-resistant multi-factor authentication for human users of systems, which asks for the same thing.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.5Secure authentication technologies and proceduresPartially meets
ASD ISM

ASD Information Security Manual: 11 mappings

  • ISM-1682Phishing-resistant multi-factor authentication for human users of systemsEquivalent
  • ISM-1401Multi-factor authentication combines possession with knowledge or inherencePartially meets
  • ISM-1173Multi-factor authentication for privileged human users of systemsPartially overlaps
  • ISM-1505Multi-factor authentication for human users of data repositoriesPartially overlaps
  • ISM-1680Multi-factor authentication for human users of third-party services holding non-sensitive dataPartially overlaps
  • ISM-1872Phishing-resistant multi-factor authentication for human users of online servicesPartially overlaps
  • ISM-1894Phishing-resistant multi-factor authentication for human users of data repositoriesPartially overlaps
  • ISM-0974Multi-factor authentication for unprivileged human users of systemsSupports
ASD Essentials

ASD Essentials for enterprise IT: 1 mapping

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.