11.7.2 The relevant entities shall ensure that the strength of authentication is appropriate for the …

Requirement

The relevant entities shall ensure that the strength of authentication is appropriate for the classification of the asset to be accessed.

Guidance

• Determine which network and information systems require the use of MFA protection based on the classification of the asset to be accessed. Wherever possible, use phishing-resistant MFA.
• Analyse user roles and the level of access required by each role to determine appropriate MFA methods.
• Consider MFA, in particular when accessing systems from a remote location, accessing system administration systems, access to sensitive information, etc.
• Enforce MFA on internet-facing systems, such as email, remote desktop and VPNs (99).
• Define when and how MFA is required (e.g. every login, once per session or for high-risk actions).

Examples of evidence

• Documentation detailing the classification of assets and the associated requirement for MFA protection.
• Risk assessment results justifying the need for MFA on certain network and information systems.
• List of user roles, associated access rights and the analysis conducted to determine appropriate MFA methods.
• Configuration files and logs showing MFA enabled on specific network and information systems.
• Settings from authentication systems reflecting the defined MFA requirements.
• Logs from authentication systems showing enforcement of these MFA requirements.

Tips: guidance

• Integrate MFA with SSO solutions for seamless access. Wherever possible, use phishing-resistant MFA.
• Implement secure fallback methods for users who lose access to their MFA methods.
• Educate users about the importance of MFA and how to use it.
• Regularly monitor MFA logs for suspicious activity.
• Keep the MFA system and associated devices updated.
• Combine MFA with other techniques to require additional factors under specific circumstances, based on predefined rules and patterns, such as access from an unusual location, from an unusual device or at an unusual time.
• Evaluate and choose an MFA provider that fits the entity’s requirements:
  • ease of integration: ensure the MFA solution integrates well with the existing systems;
  • user experience: aim for a balance between security and user convenience;
  • scalability: choose a solution that can grow with the entity;
  • support and reliability: ensure the provider offers robust support and high reliability.
• Pilot test the MFA solution with a small group of users.
• Ensure that MFA implementation meets legal requirements (e.g. the GDPR).

Tips: examples of evidence

• Manuals, configuration files or screenshots demonstrating the successful integration of MFA with an SSO provider.
• Records of training sessions, attendance lists and training materials provided to users about the importance and usage of MFA.
• Regularly generated reports from MFA systems showing log monitoring activities and any suspicious activities detected.
• Configuration files showing the implementation of additional authentication factors based on predefined rules.

1. Επισκόπηση

1.1 Παραπομπές

1.2 Εντοπισμένες απαιτήσεις

1.3 Σχετικοί κανονισμοί

2. Εντοπισμένες απαιτήσεις

3. Σχετικοί κανονισμοί

Συνδεδεμένα ζητήματα

• ENISA -