11.7.1 The relevant entities shall ensure that users are authenticated by multiple authentication factors …

Requirement

The relevant entities shall ensure that users are authenticated by multiple authentication factors or continuous authentication mechanisms for accessing the entities’ network and information systems, where appropriate, in accordance with the classification of the asset to be accessed.

Guidance

• Select appropriate MFA (97) methods and continuous authentication mechanisms based on the entity’s security needs and depending on the classification of the asset. It is also good practice to consider user convenience when selecting and implementing a solution:
  • test-message-based OTP: simple but less secure due to risks such as SIM swapping;
  • authenticator apps: generate time-based OTPs;
  • push notifications: send an approval request to a user’s device;
  • hardware tokens: for example physical devices generating OTPs, smart cards;
  • passkeys;
  • Fast Identity Online 2 security keys;
  • biometrics: fingerprints, facial recognition, etc.
  • Consider continuous authentication (98) for avoiding specific threats such as session hijacking, credential theft and insider threats.

Examples of evidence

• Logs showing MFA being used to access network and information systems.
• Configuration of authentication solutions implementing MFA.
• Access control policy outlining how different MFA methods are assigned, including whether phishing-resistant MFA is used.

1. Oversigt

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

3. Relaterede reguleringer

Linkede sager

• ENISA -