ASD ISM 1874 Phishing-resistant multi-factor authentication for customers
What it says
Multi-factor authentication used for authenticating customers of online customer services is phishing-resistant.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOnline services use multi-step security to prevent phishing attacks during customer login.
This control is about using multi-step security checks that are hard for scammers to trick when you log in online. It matters because if you don't have these strong checks, someone pretending to be you could get into your accounts and steal your information or money.
Free. Save your status, tasks and notes.
Why it matters
Without phishing-resistant MFA, attackers can impersonate customers, leading to significant data breaches and financial losses.
How to implement
IT team should implement phishing-resistant multi-factor authentication (MFA) for customer logins.
They can do this by choosing and setting up an authentication method like a hardware security key or a mobile app that generates unique codes. This adds an extra layer of security that is not easily fooled by phishing attempts.
System administrators need to ensure that all online services used by customers are configured to require the chosen MFA method.
This can be done by adjusting the authentication settings to make MFA a mandatory step during each login process.
Customer support managers should inform customers about the new MFA process and why it's important.
They can do this by sending out emails, updating websites, and providing simple guides on how to use the new method effectively.
IT security trainers should provide training sessions for staff on how phishing-resistant MFA works and why it's beneficial.
These sessions should include examples of phishing attacks and hands-on practice with the new authentication process.
Risk management officers need to conduct a risk assessment to ensure that the selected MFA method effectively reduces the threat of phishing.
This involves evaluating different MFA options and selecting one that best suits the organisation's customer base and threat landscape.
Keep it running
Use phishing-resistant MFA for customers (e.g., FIDO2/WebAuthn passkeys) and monitor for OTP/push fatigue; keep enrolment and recovery guidance current.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The documentation on the MFA system implemented for customer accounts.
Look at
Whether the MFA system described is phishing-resistant and how it is applied across all customer logins.
Good evidence
Is documentation that clearly explains the phishing-resistant features and their implementation timeline.
- Check 2 of 5What an auditor asks for
Ask for
Records of customer communications regarding the introduction of phishing-resistant MFA.
Look at
The content of these communications to see if they explain the reasons for the change and provide clear instructions.
Good evidence
Includes copies of emails, newsletters, or a website notice explaining MFA benefits and usage.
- Check 3 of 5What an auditor asks for
Look at
Whether these materials cover both how to use the system and why it's important to prevent phishing.
Good evidence
Includes slides, videos, or training manuals with clear explanations and example scenarios.
- Check 4 of 5What an auditor asks for
Ask for
Logs showing the enforcement of MFA in customer accounts. Look to see logs include details when MFA was required and if any login attempts were rejected due to phishing attempts.
Good evidence
Is logs that demonstrate consistent requirement of MFA and clear record of failed phishing attempts.
- Check 5 of 5What an auditor asks for
Look at
Whether the assessment evaluated phishing threats and the effectiveness of the MFA solution.
Good evidence
Is a detailed report outlining the risks identified and the reasons behind the choice of MFA.
Mappings
Closest match in ASD Essential Eight: E8-MF-ML3.2, Phishing-resistant multi-factor authentication for online customer services, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.5.
ISM-1874 requires a specific secure authentication outcome: phishing-resistant MFA for customers of online customer services. ISO/IEC 27001:2022 Annex A 8.5 requires implementing secure authentication technologies and procedures based on access restrictions and access control policy, which can include MFA and phishing-resistant methods. ISM-1874 is a concrete, customer-facing instantiation of the broader secure authentication requirement in Annex A 8.5.
ASD Essential Eight: 4 mappings
This control is equivalent to E8-MF-ML3.2.
ISM-1874 requires that multi-factor authentication used to authenticate customers of online customer services is phishing-resistant. E8-MF-ML3.2 states the same requirement for online customer services and explicitly mandates phishing-resistant MFA for customer authentication. The scope (customers + online customer services) and the security property (phishing-resistance) align closely with no material difference in intent.
- E8-MF-ML2.4Offer customers a phishing-resistant multi-factor authentication option for online customer servicesBroader than
This control is broader than E8-MF-ML2.4.
E8-MF-ML2.4 requires that multi-factor authentication for customers of online customer services offers at least one phishing-resistant option, while ISM-1874 requires that this customer multi-factor authentication is phishing-resistant. Meeting ISM-1874 also meets E8-MF-ML2.4, so E8-MF-ML2.4 is a lower-bar subset of ISM-1874.
- E8-MF-ML1.6Multi-factor authentication for customer access to online services handling sensitive dataPartially overlaps
This control partially overlaps E8-MF-ML1.6.
E8-MF-ML1.6 requires MFA for customers authenticating to online services handling sensitive customer data. ISM-1874 further constrains that customer MFA for online customer services must be phishing-resistant, which strengthens the same authentication scenario. E8-MF-ML1.6 mandates MFA use generally, whereas ISM-1874 focuses on the quality/type of MFA rather than simply requiring MFA everywhere it applies.
This control partially overlaps E8-MF-ML2.3.
E8-MF-ML2.3 requires phishing-resistant MFA for users authenticating to online services. ISM-1874 applies the phishing-resistant MFA requirement to customers of online customer services, which is a specific subset of online services focused on customer authentication. They overlap on phishing-resistant MFA for online service authentication, but E8-MF-ML2.3 targets organisational user access while ISM-1874 targets customer-facing authentication.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.