Multi-factor authentication

search account_circle

boltEssential 8

Multi-factor authentication

23 controls in this part of theEssential Eight mitigation strategies. Each control links to plain-English guidance, audit tips and cross-framework mappings.

Require multi-factor authentication for sensitive online services

Ensure users use multiple ways to verify their identity when accessing sensitive company data online

Multi-factor authentication for third-party services handling sensitive data

Use multi-factor authentication for third-party services with sensitive data to prevent unauthorized

Use multi-factor authentication for non-sensitive third-party services

Use a second form of verification for accounts on services handling non-sensitive org data.

Use multi-factor authentication for online services handling customer data

Ensure users use multi-factor logins for online services with sensitive customer data.

Multi-factor authentication for third-party services with sensitive customer data

Use multi-factor authentication to secure accounts on third-party services that handle your sensitiv

Multi-factor authentication for customer access to online services handling sensitive data

Require multiple forms of ID for customer logins to protect sensitive online data.

Multi-factor authentication combines two factors like a device and a PIN

Use something you have and something you know to secure access to important data.

Multi-factor authentication for privileged users of systems

Ensure privileged users use more than just a password to access systems.

Use multi-factor authentication for unprivileged user access

Require additional authentication methods for regular system users.

Multi-factor authentication online services must be phishing-resistant

Ensure two-factor authentication can't be bypassed by phishing attacks.

Multi-factor authentication used for system access is phishing-resistant

Ensure system login methods resist phishing attacks using multiple authentication factors.

MFA success and failure events are centrally logged

Ensure all successful and failed MFA attempts are logged in one central location.

Protect event logs from unauthorised changes

Ensure event logs cannot be changed or deleted without permission.

Timely analysis of event logs from internet-facing servers

Regularly check logs from online servers to quickly spot security issues.

Cybersecurity events are analysed to identify incidents timely

Timely analyse cybersecurity events to identify incidents quickly.

Report cyber security incidents to the Chief Information Security Officer promptly

Notify the Chief Information Security Officer quickly after discovering cyber attacks.

Report cybersecurity incidents to ASD immediately

Notify ASD quickly when a cybersecurity incident occurs or is discovered.

Cybersecurity incident response plan enacted after incident identification

Activate the response plan immediately once a cyber incident is detected.

Multi-factor authentication is used to authenticate users of data repositories

Use multiple verification methods to authorise access to data storage systems.

Phishing-resistant multi-factor authentication for online customer services

Use multi-factor authentication that resists phishing for customers accessing online services.

Phishing-resistant multi-factor authentication for data repositories

Use secure multi-factor authentication methods to protect data repositories against phishing attacks

Analyse event logs from non-internet-facing servers timely to detect security events

Regularly check event logs from internal servers to catch security issues quickly.

Timely analysis of workstation event logs for cybersecurity events

Ensure workstation event logs are reviewed quickly to spot cybersecurity issues.

Back to the full Essential Eight control list, or browse the complete control library.