ASD ISM 1504 Multi-factor authentication for human users of sensitive data online services
What it says
Multi-factor authentication is used to authenticate human users to their organisation's online services that process, store or communicate their organisation's sensitive data.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEvery person logging in to an organisation's own online services that handle its sensitive data must prove who they are with more than a password.
This control says that whenever a human user (a staff member, contractor or other person, as opposed to a system account) signs in to one of the organisation's online services, and that service processes, stores or communicates the organisation's sensitive data, the sign-in must use multi-factor authentication (MFA). MFA means the user has to present something beyond a password, such as an authenticator app code, a hardware security key or a passkey. It matters because a password on its own is the weakest link in an online service. Passwords are phished, reused across sites, guessed, or leaked in third-party breaches, and an online service is by definition reachable from anywhere. If a password is all that stands between an attacker and a webmail, file-sharing, HR, finance or customer portal that holds sensitive data, one successful phishing email is enough. Requiring a second factor means a stolen password alone does not get the attacker in. The scope is deliberate: it is about the organisation's own online services, it is about the ones that touch sensitive data, and it is about the human users who log in to them. Any service that meets that description is in scope, whether it is hosted in-house, in the cloud, or provided as software-as-a-service.
Free. Save your status, tasks and notes.
Why it matters
If MFA is not enforced on these services, a single compromised password gives an attacker the same access to sensitive data as the legitimate user. Credential phishing, password spraying and reuse of passwords leaked elsewhere are the most common ways organisations are breached, and an online service without MFA turns each of those into a direct path to the data. The likely consequences are theft or exposure of sensitive information, tampering with records, follow-on attacks launched from a trusted account (such as business email compromise), regulatory and notification obligations, and loss of trust from customers, partners and staff.
How to implement
The information security manager, working with system owners, inventories every online service the organisation operates or subscribes to that processes, stores or communicates its sensitive data, and records each one in a register marked as in scope for MFA.
The identity and access administrator configures the organisation's identity provider (or the service's own authentication settings) to require MFA for all human user sign-ins to each in-scope service, using an enforcement policy rather than a per-user option.
The IT service desk enrols every human user in an MFA method (for example an authenticator app, hardware security key or passkey) as part of account provisioning, and verifies enrolment is complete before the user is given access to an in-scope service.
The identity and access administrator disables or blocks any legacy or alternative sign-in path to in-scope services that would let a user authenticate with a password alone, such as basic authentication or older protocol endpoints.
The system owner for each in-scope service runs a regular report of human user accounts without MFA enrolled or sign-ins that did not complete MFA, and works with the service desk to remediate each account or close each gap.
Keep it running
Day to day, this control lives in the identity and access configuration of each in-scope service. Someone needs to own an up-to-date list of the organisation's online services that process, store or communicate sensitive data, so that new services (including ones adopted by business units on their own) are identified and brought under the MFA requirement before people start using them.
For each of those services, MFA should be enforced by policy in the identity provider or the service itself rather than left as an opt-in setting users can decline. Onboarding of new human users should include enrolling their second factor, and offboarding should remove it along with the account. Expect a steady trickle of support tasks: lost or replaced phones, new hardware keys, re-enrolment after a device change, and temporary exceptions. Those exceptions are where the control tends to erode, so they should be time-limited, recorded and reviewed.
Periodic checks are also part of routine operation: confirm that no in-scope service still permits password-only sign-in, look for accounts that have never enrolled a second factor, and review sign-in logs for logins that bypassed MFA.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the register or list of the organisation's online services that process, store or communicate its sensitive data.
Look at
Check that the list is current, names an owner for each service, and is not missing obvious services such as email, file sharing, HR, finance or customer portals.
Good evidence
A maintained register exists, covers all sensitive-data online services, and each entry is marked as requiring MFA for human users.
- Check 2 of 5What an auditor asks for
Ask for
Ask for the MFA enforcement policy configuration from the identity provider or from each in-scope service.
Look at
Confirm the policy applies to all human user accounts for those services and that MFA is mandatory rather than optional or self-selected.
Good evidence
Exported policy settings or screenshots show MFA required for every human user sign-in to each in-scope service, with no broad exclusions.
- Check 3 of 5What an auditor asks for
Ask for
Ask for a report of human user accounts on in-scope services and their MFA enrolment status.
Look at
Look for accounts with no second factor enrolled, and for how long they have been in that state.
Good evidence
Every active human user account on an in-scope service has an MFA method enrolled, or is disabled until enrolment is completed.
- Check 4 of 5What an auditor asks for
Ask for
Ask for recent sign-in logs for a sample of in-scope services.
Look at
Check whether any successful sign-ins by human users were completed with a password only, and whether any legacy authentication paths are still in use.
Good evidence
Sampled sign-ins all show a completed second factor, and no password-only or legacy-protocol logins to in-scope services appear.
- Check 5 of 5What an auditor asks for
Ask for
Ask for the record of MFA exceptions or bypasses granted for in-scope services.
Look at
Review why each exception was granted, who approved it, when it expires, and whether it was actually removed.
Good evidence
Exceptions are rare, documented, approved, time-limited, and closed on schedule, with none left open indefinitely.
Mappings
Closest match in ASD Essential Eight: E8-MF-ML1.1, Require multi-factor authentication for sensitive online services, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control is broader than A.6.7.
Annex A 6.7 requires organisations to implement security measures to protect information accessed, processed or stored while personnel work remotely. ISM-1504 mandates multi-factor authentication for online services handling sensitive organisational data, which is a common core control for securing remote access. ISM-1504 is one specific technical measure within the broader remote-working security regime that Annex A 6.7 expects (which can also include device hardening, secure connectivity, monitoring, and user guidance).
This control partially meets A.8.5.
ISM-1504 requires MFA for authenticating users to the organisation's online services that process, store or communicate sensitive data. ISO/IEC 27001:2022 Annex A 8.5 requires implementing secure authentication technologies and procedures more generally, based on access restrictions and access control policy, which can include MFA among other mechanisms. ISM-1504 is a specific prescriptive instance (MFA for sensitive online services) within the broader authentication-control expectations of Annex A 8.5.
ASD Essential Eight: 10 mappings
This control is equivalent to E8-MF-ML1.1.
ISM-1504 requires multi-factor authentication to authenticate human users to the organisation's online services that process, store or communicate the organisation's sensitive data. E8-MF-ML1.1 states the same requirement for MFA on the organisation's online services handling the organisation's sensitive data. Both controls match in subject (human users), mechanism (MFA), and scope (organisation online services handling sensitive data).
- E8-MF-ML3.1Multi-factor authentication is used to authenticate users of data repositoriesBroader than
This control is broader than E8-MF-ML3.1.
E8-MF-ML3.1 requires MFA for users of data repositories. ISM-1504 mandates MFA for users accessing the organisation's online services that process, store or communicate sensitive data, which can include repository access where delivered as an online service. ISM-1504 is broader in scope (online services generally), while E8-MF-ML3.1 is specifically focused on data repositories.
- E8-MF-ML1.2Multi-factor authentication for third-party services handling sensitive dataPartially overlaps
This control partially overlaps E8-MF-ML1.2.
ISM-1504 requires MFA for human users of the organisation's own online services that handle the organisation's sensitive data. E8-MF-ML1.2 overlaps by applying the same MFA requirement to third-party online services that process, store or communicate the organisation's sensitive data. They align on protecting access to sensitive-data services with MFA, but differ on service ownership (internal vs third-party).
- E8-MF-ML1.4Use multi-factor authentication for online services handling customer dataPartially overlaps
This control partially overlaps E8-MF-ML1.4.
ISM-1504 requires MFA for users accessing the organisation's online services that process, store or communicate sensitive data. E8-MF-ML1.4 applies the same MFA requirement specifically to the organisation's online customer services handling sensitive customer data. The controls align on MFA for sensitive-data-bearing online services, but E8-MF-ML1.4 is narrower to customer services and customer data, while ISM-1504 is broader across sensitive data types and online services generally (not only customer services).
- E8-MF-ML1.5Multi-factor authentication for third-party services with sensitive customer dataPartially overlaps
This control partially overlaps E8-MF-ML1.5.
ISM-1504 requires MFA for users authenticating to the organisation's online services that handle sensitive data. E8-MF-ML1.5 requires MFA for users authenticating to third-party online customer services that handle sensitive customer data. They overlap on using MFA to protect access to services processing sensitive information, but E8-MF-ML1.5 is third-party and customer-service specific, which is not explicitly covered by ISM-1504.
- E8-MF-ML1.6Multi-factor authentication for customer access to online services handling sensitive dataPartially overlaps
This control partially overlaps E8-MF-ML1.6.
ISM-1504 requires MFA for users authenticating to the organisation's online services that handle sensitive data. E8-MF-ML1.6 shifts the subject from internal users to customers authenticating to online customer services handling sensitive customer data. The overlap is the MFA protection of access to sensitive-data services, but E8-MF-ML1.6 covers customer authentication (external identities) which is not explicitly in ISM-1504's user-focused requirement.
This control partially overlaps E8-MF-ML3.3.
ISM-1504 requires MFA for user access to the organisation's online services that handle sensitive data. E8-MF-ML3.3 specifically requires phishing-resistant MFA for access to data repositories, raising the assurance for a particular class of systems. The overlap exists where repositories are accessed via online services handling sensitive data, but E8-MF-ML3.3 is both narrower (repositories) and deeper (phishing-resistant) than ISM-1504.
This control supports E8-MF-ML1.7.
ISM-1504 requires organisations to use multi-factor authentication for user access to online services handling sensitive data. E8-MF-ML1.7 defines acceptable MFA factor combinations (something you have + something you know, or a protected something you have unlocked by knowledge/biometrics), which helps implement ISM-1504 correctly. The candidate is about MFA construction/definition, while ISM-1504 is about where MFA must be applied (online services with sensitive data).
This control supports E8-MF-ML2.3.
ISM-1504 requires MFA for users authenticating to online services that process, store or communicate sensitive data. E8-MF-ML2.3 strengthens that requirement by specifying that the MFA used for online services must be phishing-resistant, which improves the effectiveness of MFA deployments. ISM-1504 does not specify the MFA modality or phishing resistance, so E8-MF-ML2.3 supports ISM-1504 by raising assurance rather than changing the fundamental requirement.
This control supports E8-MF-ML2.6.
ISM-1504 requires MFA to be used for authenticating users to online services handling sensitive data. E8-MF-ML2.6 requires central logging of successful and unsuccessful MFA events, which supports ISM-1504 by enabling monitoring, detection of attacks (e.g., MFA fatigue, brute forcing), and auditability of MFA enforcement. ISM-1504 does not address logging, so the candidate strengthens operational assurance rather than duplicating the core MFA requirement.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.