ASD ISM 1681 Mandating multi-factor authentication for customer services
What it says
Multi-factor authentication is used to authenticate customers to online customer services that process, store or communicate sensitive customer data.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCustomers must use multi-factor authentication when accessing sensitive online services.
This control requires using more than just a password to access online services that handle sensitive data. It's essential because passwords can be easily stolen or guessed, which can lead to unauthorised access to customer information and potential financial and reputational losses.
Free. Save your status, tasks and notes.
Why it matters
Without MFA, customer logins can be compromised via password theft and credential stuffing, exposing sensitive customer data and damaging trust.
How to implement
Business owners should instruct their IT team to set up multi-factor authentication for all customer-facing platforms.
This means combining a password with another factor like a code sent to a mobile phone.
Managers need to ensure that customers are informed about the multi-factor authentication process.
They can do this by updating user guides and sending out communications that explain the additional authentication step.
The IT team should regularly test the multi-factor authentication setup to ensure it works correctly.
They can perform periodic checks by simulating user logins and going through the authentication steps.
Customer service representatives should be trained to assist customers who may encounter issues with multi-factor authentication.
This can be done by creating FAQ documents and holding training sessions.
Business owners should contact their platform vendors to confirm if multi-factor authentication features are available.
They can ask for setup support and ongoing technical assistance if needed.
Keep it running
Enforce MFA for all customer logins to services handling sensitive data; monitor auth failures for stuffing, and periodically review MFA method strength and enrolment coverage.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
The multi-factor authentication configuration documents.
Look at
Whether there are details of the methods used, such as SMS codes or authentication apps.
Good evidence
Includes current settings and instructions on how customers use these methods.
- Check 2 of 3What an auditor asks for
Ask for
Communication records sent to customers about the authentication change. Review emails, letters or website updates for clarity and accuracy in explaining the change. Good practice includes clearly dated and reader-friendly materials.
- Check 3 of 3What an auditor asks for
Ask for
To see vendor contracts or support agreements for the authentication systems.
Look at
Clauses specifying multi-factor authentication support and vendor assistance. A satisfactory answer includes relevant sections highlighted, ensuring prompt response for technical problems.
Mappings
Closest match in ASD Essential Eight: E8-MF-ML1.6, Multi-factor authentication for customer access to online services handling sensitive data, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.5.
ISM-1681 requires MFA for customers authenticating to online customer services that handle sensitive customer data. ISO/IEC 27001:2022 Annex A 8.5 requires secure authentication technologies and procedures based on access restrictions and access control policy, which can include MFA but is not limited to it. ISM-1681 is a specific prescriptive instance of the broader authentication control in Annex A 8.5.
ASD Essential Eight: 8 mappings
- E8-MF-ML1.6Multi-factor authentication for customer access to online services handling sensitive dataEquivalent
This control is equivalent to E8-MF-ML1.6.
ISM-1681 requires multi-factor authentication (MFA) to be used to authenticate customers to online customer services that process, store or communicate sensitive customer data. E8-MF-ML1.6 states the same requirement for customer access to such online services. Both controls have the same subject (customers), channel (online customer services), and trigger (sensitive customer data), so implementing one would largely satisfy the other.
This control is broader than E8-MF-ML1.7.
E8-MF-ML1.7 requires MFA to use specific factor combinations (something users have plus something they know, or a device unlocked by knowledge/biometrics). ISM-1681 requires MFA for customers accessing online customer services that handle sensitive customer data, and such MFA should meet the factor requirements in E8-MF-ML1.7 to be considered true MFA. ISM-1681 is narrower because it is scoped to customer authentication for customer services rather than defining MFA generally.
- E8-MF-ML3.2Phishing-resistant multi-factor authentication for online customer servicesPartially meets
This control partially meets E8-MF-ML3.2.
ISM-1681 requires MFA for customers authenticating to online customer services that handle sensitive customer data. E8-MF-ML3.2 goes further by requiring that the MFA used for customers of online customer services is phishing-resistant. ISM-1681 is a baseline MFA mandate, while E8-MF-ML3.2 adds a stricter quality requirement on the MFA method.
This control partially overlaps E8-MF-ML1.1.
ISM-1681 requires MFA for customers accessing online customer services that handle sensitive customer data. E8-MF-ML1.1 requires MFA for users accessing the organisation's online services that handle the organisation's sensitive data, which may include employees and may not be limited to customer services. They overlap on the use of MFA for online services handling sensitive information, but differ in scope (customers/customer data vs users/organisation data).
- E8-MF-ML1.2Multi-factor authentication for third-party services handling sensitive dataPartially overlaps
This control partially overlaps E8-MF-ML1.2.
ISM-1681 mandates MFA for customers accessing the organisation's online customer services that handle sensitive customer data. E8-MF-ML1.2 mandates MFA for users accessing third-party online services that handle the organisation's sensitive data. They overlap on applying MFA to online services handling sensitive information, but differ on both the service ownership (organisation-run vs third-party) and the data focus (customer data vs organisation data).
- E8-MF-ML1.4Use multi-factor authentication for online services handling customer dataPartially overlaps
This control partially overlaps E8-MF-ML1.4.
ISM-1681 requires MFA for customers authenticating to online customer services where sensitive customer data is processed, stored or communicated. E8-MF-ML1.4 requires MFA for users authenticating to the organisation's online customer services that handle sensitive customer data. They align on the system scope (online customer services) and data sensitivity, but differ on the actor (customers in ISM-1681 versus users in E8-MF-ML1.4, which could include staff and administrators).
- E8-MF-ML1.5Multi-factor authentication for third-party services with sensitive customer dataPartially overlaps
This control partially overlaps E8-MF-ML1.5.
E8-MF-ML1.5 and ISM-1681 both apply MFA in customer-service environments handling sensitive customer data. However, ISM-1681 focuses on customers (external) authenticating, while E8-MF-ML1.5 covers users (typically organisational) accessing third-party services.
- E8-MF-ML2.4Offer customers a phishing-resistant multi-factor authentication option for online customer servicesSupports
This control supports E8-MF-ML2.4.
E8-MF-ML2.4 requires that multi-factor authentication used for customers of online customer services offers a phishing-resistant option, while ISM-1681 requires customers to be authenticated with multi-factor authentication on online customer services that process, store or communicate sensitive customer data. E8-MF-ML2.4 strengthens the customer multi-factor authentication that ISM-1681 puts in place, so it relies on ISM-1681 being met first.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.