ASD ISM 1873 Enhance security with phishing-resistant MFA
What it says
Multi-factor authentication used for authenticating customers of online customer services provides a phishing-resistant option.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOnline services should use multi-factor authentication that cannot be easily tricked by phishing.
Phishing-resistant multi-factor authentication is a way to double-check that you are who you say you are when accessing online services. This is important because regular passwords can be easily stolen or guessed, leading to fraud or data breaches, while phishing-resistant methods are much harder for attackers to bypass.
Free. Save your status, tasks and notes.
Why it matters
Without phishing-resistant MFA for customer logins, phished credentials and OTPs can be replayed, enabling account takeover and data breaches.
How to implement
IT team should implement phishing-resistant multi-factor authentication by setting up systems that use physical security keys or phone apps that cannot be easily tricked.
These tools add an extra layer of security that goes beyond just a password, making it much harder for hackers to access accounts without authorisation.
Managers should educate staff about the importance of multi-factor authentication by organising simple training sessions.
Explain how using these secure methods protects our data and the organisation's reputation, and provide step-by-step instructions for setting it up on commonly used services.
The HR department should incorporate the use of phishing-resistant multi-factor authentication in the onboarding process.
Clearly explain and document the steps new employees need to follow to set up these security measures, ensuring everyone is protected from day one.
Security officers should regularly review the effectiveness of phishing-resistant multi-factor authentication by analysing incident reports to check if any security breaches are related to failures in this area.
Use the findings to adapt and strengthen security measures as needed.
Keep it running
Offer phishing-resistant MFA (FIDO2/WebAuthn/passkeys) for customer logins; disable SMS/OTP-only flows where possible and monitor for MFA fatigue/replay.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
The multi-factor authentication policy document: Request the document that outlines how phishing-resistant methods are implemented. Look to see if it includes specific measures like security keys or app-based authentication.
Good evidence
Is a detailed policy that is updated regularly and includes examples of the technology used.
- Check 2 of 4What an auditor asks for
Ask for
A list of services using phishing-resistant multi-factor authentication: Check if all critical services, like email and financial software, are covered. Good evidence would show all services are using secure authentication with no exceptions.
Look at
Training dates, attendance, and content covered.
Good evidence
Record includes recent training sessions that reach all employees, with clear feedback mechanisms.
- Check 3 of 4What an auditor asks for
Ask for
To see recent security incidents reports involving authentication.
Look at
Whether the incidents were able to bypass multi-factor authentication and what type of phishing-resistant methods were in place.
Good evidence
Outcome shows minimal incidents and effective response plans.
- Check 4 of 4What an auditor asks for
Good evidence
Process is straightforward, consistently applied, and includes clear instructions tailored to both tech-savvy and non-tech staff.
Mappings
Closest match in ASD Essential Eight: E8-MF-ML2.4, Offer customers a phishing-resistant multi-factor authentication option for online customer services, which asks for the same thing.
ASD Essential Eight: 3 mappings
- E8-MF-ML2.4Offer customers a phishing-resistant multi-factor authentication option for online customer servicesEquivalent
This control is equivalent to E8-MF-ML2.4.
E8-MF-ML2.4 and ISM-1873 both require that multi-factor authentication used for authenticating customers of online customer services provides a phishing-resistant option. The two statements are worded identically, so they are the same requirement.
This control is equivalent to E8-MF-ML3.2.
ISM-1873 requires that multi-factor authentication (MFA) for authenticating customers of online customer services provides a phishing-resistant option. E8-MF-ML3.2 states the same requirement for online customer services, explicitly mandating phishing-resistant MFA for customers. The scope and intent align closely (customer authentication to online customer services, with phishing resistance as the key property).
- E8-MF-ML1.6Multi-factor authentication for customer access to online services handling sensitive dataDepends on
This control depends on E8-MF-ML1.6.
E8-MF-ML1.6 requires MFA for customers accessing online customer services that handle sensitive customer data. ISM-1873 requires that customer MFA provides a phishing-resistant option, which improves resilience to credential phishing for those customer logins. This supports E8-MF-ML1.6 by strengthening the MFA implementation rather than changing the baseline requirement for MFA.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.