Essential Eight MF-ML3.3 Phishing-resistant multi-factor authentication for data repositories
What it says
Multi-factor authentication used for authenticating users of data repositories is phishing-resistant.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse secure multi-factor authentication methods to protect data repositories against phishing attacks.
This control is about making sure that when people access data stored in digital libraries or storage areas, they use a secure form of sign-in that can't be easily tricked by fake requests for their information. Without this, someone could pretend to be them and access sensitive or important data, causing harm or leading to data breaches.
Free. Save your status, tasks and notes.
Why it matters
Without phishing-resistant MFA for data repositories, attackers can phish credentials and MFA prompts to access sensitive data and exfiltrate it.
How to implement
Security Officer: Ensure that all data repositories require multi-factor authentication (MFA) that can resist phishing attempts.
Implement systems that ask for both a password and a security token, such as an app-generated code.
IT Team: Test the current MFA methods in place for data repositories and upgrade to options that are not susceptible to phishing, like app-based or biometric authentication, by following vendor setup guides.
System Administrator: Regularly check and update the authentication systems to ensure they are using the latest methods for resisting phishing, by reviewing vendor updates and applying patches.
Training Officer: Educate all staff about recognising and avoiding phishing attempts that target MFA, using simple training sessions or workshops, exemplifying real-world scenarios.
Keep it running
Enforce phishing-resistant MFA (FIDO2/WebAuthn or client certificates) for repository access, disable SMS/OTP, and monitor for repeated MFA prompts and device re-registrations.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Does the organisation use phishing-resistant multi-factor authentication for accessing data repositories?
Look at
Examine access logs to verify that MFA involves methods such as an app-based authenticator or biometrics, not just SMS codes.
Good evidence
The organisation uses both a password and a secure token or biometric feature for authentication, and has documented records of its implementation and updates.
- Check 2 of 2What an auditor asks for
Ask for
How are MFA failures logged and reviewed?
Look at
Check system logs and security reviews to ensure failed MFA attempts are tracked and analysed for cyber threats.
Good evidence
All authentication attempts are logged, and unsuccessful attempts are reviewed regularly to identify security weaknesses.
Mappings
Closest match in ASD Information Security Manual: ISM-1894, Phishing-resistant multi-factor authentication for human users of data repositories, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.17.
E8-MF-ML3.3 requires phishing-resistant MFA for accessing data repositories. ISO/IEC 27001:2022 Annex A 5.17 is broader, requiring controlled allocation and management of authentication information (e.g., credential lifecycle and handling), which underpins how MFA credentials and authenticators are issued and governed. E8-MF-ML3.3 is a specific technical requirement that sits within the wider authentication management practices expected by Annex A 5.17.
This control partially meets A.8.5.
E8-MF-ML3.3 requires a specific control: phishing-resistant MFA for users of data repositories. ISO/IEC 27001:2022 Annex A 8.5 broadly requires secure authentication technologies and procedures based on access restrictions and access control policy, which can include MFA choices and anti-phishing measures. E8-MF-ML3.3 is a specific implementation case under the broader secure authentication expectations of Annex A 8.5.
ASD Information Security Manual: 8 mappings
- ISM-1894Phishing-resistant multi-factor authentication for human users of data repositoriesEquivalent
This control is equivalent to ISM-1894.
E8-MF-ML3.3 requires that multi-factor authentication (MFA) used to access data repositories is specifically phishing-resistant. ISM-1894 states the same requirement for phishing-resistant MFA for authenticating users of data repositories. The scope and intent align closely (data repositories + phishing resistance), so implementing one would largely satisfy the other.
This control partially meets ISM-1505.
E8-MF-ML3.3 requires phishing-resistant MFA for authenticating users of data repositories. ISM-1505 requires MFA for users of data repositories but does not, by itself, require that the MFA method is phishing-resistant. E8-MF-ML3.3 therefore adds a specific strength/quality requirement on top of the baseline MFA requirement in ISM-1505.
This control partially meets ISM-1682.
E8-MF-ML3.3 requires phishing-resistant MFA specifically for user access to data repositories. ISM-1682 requires phishing-resistant MFA for authenticating users of systems more generally, which would include data repositories as a subset. E8-MF-ML3.3 is narrower because it targets one system class (data repositories) rather than all systems.
- ISM-1504Multi-factor authentication for human users of sensitive data online servicesPartially overlaps
This control partially overlaps ISM-1504.
ISM-1504 requires MFA for user access to the organisation's online services that handle sensitive data. E8-MF-ML3.3 specifically requires phishing-resistant MFA for access to data repositories, raising the assurance for a particular class of systems. The overlap exists where repositories are accessed via online services handling sensitive data, but E8-MF-ML3.3 is both narrower (repositories) and deeper (phishing-resistant) than ISM-1504.
- ISM-1679Multi-factor authentication for third-party services handling sensitive dataPartially overlaps
This control partially overlaps ISM-1679.
ISM-1679 requires MFA for human access to third-party online services that process, store or communicate sensitive organisational data. E8-MF-ML3.3 requires phishing-resistant MFA specifically for users of data repositories, which can include repositories holding sensitive data. The overlap is that both require MFA for protecting access to sensitive information environments, but ISM-1679 is scoped to third-party online services while E8-MF-ML3.3 is scoped to repository systems and specifies phishing resistance.
- ISM-1872Phishing-resistant multi-factor authentication for human users of online servicesPartially overlaps
This control partially overlaps ISM-1872.
ISM-1872 requires phishing-resistant MFA for human users authenticating to online services. E8-MF-ML3.3 also mandates phishing-resistant MFA, but it is scoped specifically to data repositories rather than all online services. They overlap where data repositories are accessed via online services, but each control has different primary scope boundaries (online services broadly vs data repositories specifically).
This control supports ISM-2077.
E8-MF-ML3.3 requires phishing-resistant MFA to protect access to data repositories from phishing attacks. ISM-2077 supports this outcome by prohibiting email as an out-of-band authentication channel, which is commonly phishable and susceptible to account takeover. ISM-2077 is narrower (channel restriction) and does not by itself ensure phishing-resistant MFA for data repositories.
This control depends on ISM-2011.
E8-MF-ML3.3 requires that MFA for data repository access is phishing-resistant. ISM-2011 supports E8-MF-ML3.3 by ensuring that, where phishing-resistant MFA is enabled for accounts, weaker non-phishing-resistant MFA options are disabled, reducing downgrade and bypass risk. ISM-2011 is about enforcing exclusive use of phishing-resistant MFA options, whereas E8-MF-ML3.3 is about the requirement for phishing-resistant MFA specifically on data repositories.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-13.2Store keys, secrets and tokens in approved, access-controlled repositories with MFAPartially overlaps
This control partially overlaps IT.PRO-13.2.
IT.PRO-13.2 requires authentication keys, secrets and tokens to be stored in approved secure repositories with access controls and MFA; E8-MF-ML3.3 requires the MFA used for data repository users to be phishing-resistant, a stronger form of that MFA protection.
- IT.PRO-13.4Enforce phishing-resistant MFA for all user authentication, including from untrusted locationsPartially overlaps
This control partially overlaps IT.PRO-13.4.
IT.PRO-13.4 requires phishing-resistant MFA for users authenticating to systems, including from untrusted, external or high-risk locations; E8-MF-ML3.3 requires the MFA used by users of data repositories to be phishing-resistant, one specific case of that.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.