Essential Eight MF-ML3.2 Phishing-resistant multi-factor authentication for online customer services
What it says
Multi-factor authentication used for authenticating customers of online customer services is phishing-resistant.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse multi-factor authentication that resists phishing for customers accessing online services.
This control is about making sure that when customers use your online services, they have to pass a stronger security check that can't be easily tricked by scams or fake websites. Without this, criminals could pretend to be your customers and access sensitive information, causing harm to your business and your customers.
Free. Save your status, tasks and notes.
Why it matters
Without phishing-resistant MFA, criminals can hijack customer accounts via phishing, enabling fraud, data exposure and reputational harm.
How to implement
The IT team should implement multi-factor authentication for all online customer services, requiring a second form of verification beyond a password, such as a code sent to a mobile device.
System administrators need to configure authentication systems to resist phishing attempts by using methods like hardware security keys that cannot be intercepted by attackers.
The security officer should ensure that training is provided to both staff and customers on how to use phishing-resistant authentication methods effectively.
IT staff should regularly update the authentication technology and methods to stay ahead of new phishing techniques and cyber threats.
The risk management team should conduct regular reviews of authentication logs to verify resistance against phishing attacks and ensure that the multi-factor setup is functioning as intended.
Keep it running
Use phishing-resistant MFA (FIDO2/WebAuthn or passkeys) for customers; disable SMS/OTP where possible and verify redirects and origin binding in login flows.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
Does the organisation use multi-factor authentication for their online customer services?
Look at
Check authentication logs and system configurations.
Good evidence
The system requires a password and a security token, with logs showing consistent usage by customers.
- Check 2 of 3What an auditor asks for
Ask for
Are the authentication methods used resistant to phishing?
Look at
Examine the authentication method setup, such as the use of hardware tokens or app-based verifications.
Good evidence
The system uses app-generated tokens or physical keys that cannot be easily stolen via phishing.
- Check 3 of 3What an auditor asks for
Ask for
How is user training on these methods conducted?
Look at
Review user support materials and training records.
Good evidence
Documentation and records show regular user training sessions, with materials explaining phishing-resistant practices.
Mappings
Closest match in ASD Information Security Manual: ISM-1873, Enhance security with phishing-resistant MFA, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.5.
E8-MF-ML3.2 requires phishing-resistant MFA for customers authenticating to online customer services. ISO/IEC 27001:2022 Annex A 8.5 requires secure authentication technologies and procedures based on access restrictions and access control policy. E8-MF-ML3.2 is a specific, prescriptive requirement within the broader authentication-technology governance expected by Annex A 8.5, which does not mandate phishing-resistant MFA for customers.
ASD Information Security Manual: 10 mappings
This control is equivalent to ISM-1873.
ISM-1873 requires that multi-factor authentication (MFA) for authenticating customers of online customer services provides a phishing-resistant option. E8-MF-ML3.2 states the same requirement for online customer services, explicitly mandating phishing-resistant MFA for customers. The scope and intent align closely (customer authentication to online customer services, with phishing resistance as the key property).
This control is equivalent to ISM-1874.
ISM-1874 requires that multi-factor authentication used to authenticate customers of online customer services is phishing-resistant. E8-MF-ML3.2 states the same requirement for online customer services and explicitly mandates phishing-resistant MFA for customer authentication. The scope (customers + online customer services) and the security property (phishing-resistance) align closely with no material difference in intent.
This control is broader than ISM-1681.
ISM-1681 requires MFA for customers authenticating to online customer services that handle sensitive customer data. E8-MF-ML3.2 goes further by requiring that the MFA used for customers of online customer services is phishing-resistant. ISM-1681 is a baseline MFA mandate, while E8-MF-ML3.2 adds a stricter quality requirement on the MFA method.
This control partially meets ISM-1546.
E8-MF-ML3.2 requires phishing-resistant MFA for customers of online customer services. ISM-1546 is broader, requiring users to be authenticated before access to a system and its resources, without specifying MFA or phishing-resistance. E8-MF-ML3.2 is a specific mechanism and assurance level within the broader authentication requirement of ISM-1546.
This control partially meets ISM-1682.
E8-MF-ML3.2 requires phishing-resistant MFA specifically for customers of online customer services. ISM-1682 requires that MFA used to authenticate users of systems is phishing-resistant. E8-MF-ML3.2 is a specific application of ISM-1682 to the customer-facing online services context, whereas ISM-1682 is broader across system user authentication generally.
- ISM-1872Phishing-resistant multi-factor authentication for human users of online servicesPartially meets
This control partially meets ISM-1872.
ISM-1872 requires that multi-factor authentication (MFA) used to authenticate users of online services is phishing-resistant. E8-MF-ML3.2 applies the same phishing-resistant MFA requirement but only for customers of online customer services. E8-MF-ML3.2 is therefore a subset of ISM-1872 because it narrows the user population to customers and the service type to customer services.
- ISM-1401Multi-factor authentication combines possession with knowledge or inherencePartially overlaps
This control partially overlaps ISM-1401.
E8-MF-ML3.2 requires phishing-resistant multi-factor authentication (MFA) for customers using online customer services. ISM-1401 defines acceptable MFA factor combinations (something you have and something you know/are, or a protected 'have' factor). They align on requiring MFA, but E8-MF-ML3.2 adds the specific phishing-resistant property and a customer/online-service context that ISM-1401 does not explicitly cover.
- ISM-1680Multi-factor authentication for human users of third-party services holding non-sensitive dataPartially overlaps
This control partially overlaps ISM-1680.
E8-MF-ML3.2 requires phishing-resistant MFA for authenticating customers of online customer services. ISM-1680 requires MFA (where available) for users authenticating to third-party online services handling an organisation's non-sensitive data. Both address MFA for online services, but ISM-1680 is focused on organisational use of third-party services and does not require phishing-resistance or specifically cover customer authentication.
This control partially overlaps ISM-2077.
E8-MF-ML3.2 requires phishing-resistant MFA for customers accessing online customer services. ISM-2077 prohibits using email for out-of-band authentication, reducing exposure to phishing and mailbox compromise that would undermine MFA flows. ISM-2077 supports achieving the phishing-resistant objective in E8-MF-ML3.2, but it does not itself mandate MFA or guarantee phishing-resistance.
This control depends on ISM-2011.
ISM-2011 requires that when phishing-resistant MFA is enabled for a user account, other non-phishing-resistant MFA options are disabled for that account. This supports E8-MF-ML3.2 by helping ensure customer authentication cannot be downgraded to weaker MFA methods, preserving phishing resistance for online customer services. E8-MF-ML3.2 sets the phishing-resistant requirement for customer services broadly, whereas ISM-2011 is a specific enforcement requirement about disabling alternative MFA methods once phishing-resistant MFA is in use.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-13.4Enforce phishing-resistant MFA for all user authentication, including from untrusted locationsPartially overlaps
This control partially overlaps IT.PRO-13.4.
IT.PRO-13.4 requires phishing-resistant MFA for users authenticating to systems, including from untrusted, external or high-risk locations; E8-MF-ML3.2 requires the MFA customers use for online customer services to be phishing-resistant, applying that standard to customers.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.