Essential Eight MF-ML3.1 Multi-factor authentication is used to authenticate users of data repositories
What it says
Multi-factor authentication is used to authenticate users of data repositories.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse multiple verification methods to authorise access to data storage systems.
Multi-factor authentication (MFA) is like having two locks on your door instead of one. It protects your important data by making sure that anyone trying to access it has to prove their identity in more than one way, such as knowing a password and having a mobile phone. Without MFA, cybercriminals could more easily gain access to sensitive information, potentially leading to data breaches or financial loss.
Free. Save your status, tasks and notes.
Why it matters
Without MFA, unauthorised access to data repositories is more likely, increasing exposure of sensitive data and resulting in breaches and reputational damage.
How to implement
The IT team should ensure that MFA is enabled on all data repositories.
This can be done by configuring the settings in your data management software to require multiple forms of verification for user access.
The system administrator should regularly update and test the MFA system.
They need to verify that each option, like a text to a mobile phone or an authentication app, is working correctly.
The security officer should train staff on how to use MFA.
They should explain how to set up and use their devices for authentication, ensuring everyone understands the process.
The IT team should integrate a list of approved MFA methods into the organisation's access policies.
Use only those methods that meet security standards, such as using authentication apps or security tokens.
The system administrator should monitor and support users struggling with MFA issues.
Set up a helpdesk process to quickly resolve any problems employees might have accessing systems with MFA.
Keep it running
Audit MFA on all data repositories so every access path (admin console, user UI and API/service accounts) enforces MFA, and remediate any exceptions promptly.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
Does the organisation use MFA to protect access to their data repositories?
Look at
Examine the system configuration records or policies indicating MFA settings.
Good evidence
The organisation has documented evidence showing MFA is configured on all data repositories, and staff has been trained on its use.
- Check 2 of 3What an auditor asks for
Ask for
How does the organisation ensure all MFA methods used are resistant to phishing?
Look at
Review security assessments or third-party validation of the MFA methods in use.
Good evidence
The organisation regularly updates its list of approved MFA methods to ensure they are phishing-resistant, with documented testing results available.
- Check 3 of 3What an auditor asks for
Ask for
Are MFA logs being recorded and analysed?
Look at
Check for logs in the monitoring system that record both successful and unsuccessful MFA attempts.
Good evidence
There are logs showing both types of MFA attempts, which are regularly reviewed by the IT security team.
Mappings
Closest match in ASD Information Security Manual: ISM-1505, Multi-factor authentication for human users of data repositories, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.5.
Annex A 8.5 requires organisations to implement secure authentication technologies and procedures aligned with access restrictions and the access control policy. E8-MF-ML3.1 specifically mandates multi-factor authentication (MFA) for users of data repositories, which is one specific method within the broader requirement of Annex A 8.5 that also covers other authentication forms and procedural controls beyond MFA and beyond data repositories.
ASD Information Security Manual: 9 mappings
This control is equivalent to ISM-1505.
E8-MF-ML3.1 requires multi-factor authentication (MFA) to be used to authenticate users of data repositories. ISM-1505 states the same requirement, explicitly mandating MFA for users accessing data repositories. The scope and intent align closely, with both focusing on MFA as the access control for repositories rather than broader system or service access.
- ISM-1504Multi-factor authentication for human users of sensitive data online servicesPartially meets
This control partially meets ISM-1504.
E8-MF-ML3.1 requires MFA for users of data repositories. ISM-1504 mandates MFA for users accessing the organisation's online services that process, store or communicate sensitive data, which can include repository access where delivered as an online service. ISM-1504 is broader in scope (online services generally), while E8-MF-ML3.1 is specifically focused on data repositories.
This control partially overlaps ISM-0974.
E8-MF-ML3.1 requires MFA for users accessing data repositories. ISM-0974 requires MFA for unprivileged users of systems, which may include unprivileged access paths to repository platforms or supporting systems. The overlap is that both drive MFA for user authentication, but E8-MF-ML3.1 is asset-specific (repositories) while ISM-0974 is user-class/system-wide and not repository-specific.
This control partially overlaps ISM-1173.
E8-MF-ML3.1 requires MFA for users of data repositories. ISM-1173 requires MFA for privileged users of systems, which commonly includes administrators of repository systems and storage services. The overlap is MFA for repository-related access by privileged accounts, but ISM-1173 is broader (all privileged system access) and E8-MF-ML3.1 covers all repository users, not just privileged ones.
This control supports ISM-1872.
E8-MF-ML3.1 requires MFA for users of data repositories. ISM-1872 requires that MFA used for authenticating users of online services is phishing-resistant, strengthening the assurance of MFA where repositories are accessed via online service interfaces. ISM-1872 adds a quality/strength requirement (phishing resistance) that is not explicit in E8-MF-ML3.1, so it supports rather than duplicates it.
This control supports ISM-1894.
ISM-1894 requires that where MFA is used for human users of data repositories, it must be phishing-resistant. E8-MF-ML3.1 requires that MFA is used to authenticate users of data repositories in the first place, establishing the baseline control that ISM-1894 then constrains in terms of MFA strength. Without implementing E8-MF-ML3.1 (or an equivalent MFA mandate), ISM-1894's phishing-resistance requirement for repository MFA cannot be meaningfully applied.
This control supports ISM-1920.
E8-MF-ML3.1 requires MFA to authenticate users of data repositories. ISM-1920 adds an enrolment hardening requirement by preventing users from self-enrolling into MFA from untrustworthy devices when accessing systems or data repositories. This supports E8-MF-ML3.1 by reducing the risk that MFA on repositories is undermined through insecure enrolment, but it is about MFA lifecycle controls rather than the base requirement to use MFA.
This control depends on ISM-1401.
E8-MF-ML3.1 requires MFA to authenticate users of data repositories. ISM-1401 defines acceptable MFA factor combinations (something you have/know/are), providing the technical standard for what 'MFA' means in practice. ISM-1401 supports E8-MF-ML3.1 by constraining implementations to genuine multi-factor methods, but it does not itself specify where MFA must be applied (e.g. data repositories).
This control depends on ISM-1919.
E8-MF-ML3.1 requires MFA for authenticating users of data repositories. ISM-1919 requires disabling authentication protocols that do not support MFA once MFA is used, preventing bypass paths that would undermine repository MFA. E8-MF-ML3.1 does not explicitly cover protocol hardening, so ISM-1919 supports secure enforcement of the primary control.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-13.2Store keys, secrets and tokens in approved, access-controlled repositories with MFAPartially overlaps
This control partially overlaps IT.PRO-13.2.
IT.PRO-13.2 requires authentication keys, secrets and tokens to be stored in approved secure repositories with access controls and MFA; E8-MF-ML3.1 requires MFA for users of data repositories, overlapping on the MFA part of controlling repository access.
- IT.PRO-13.4Enforce phishing-resistant MFA for all user authentication, including from untrusted locationsPartially overlaps
This control partially overlaps IT.PRO-13.4.
IT.PRO-13.4 requires phishing-resistant MFA for users authenticating to systems, including from untrusted, external or high-risk locations; E8-MF-ML3.1 requires MFA for users of data repositories, extending MFA to repositories without itself requiring phishing resistance.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.