11.7 Multi-factor authentication

Requirement

The relevant entities shall ensure that users are authenticated by multiple authentication factors or continuous authentication mechanisms for accessing the entities’ network and information systems, where appropriate, in accordance with the classification of the asset to be accessed.

Guidance

• Select appropriate MFA (97) methods and continuous authentication mechanisms based on the entity’s security needs and depending on the classification of the asset. It is also good practice to consider user convenience when selecting and implementing a solution:
  • test-message-based OTP: simple but less secure due to risks such as SIM swapping;
  • authenticator apps: generate time-based OTPs;
  • push notifications: send an approval request to a user’s device;
  • hardware tokens: for example physical devices generating OTPs, smart cards;
  • passkeys;
  • Fast Identity Online 2 security keys;
  • biometrics: fingerprints, facial recognition, etc.
  • Consider continuous authentication (98) for avoiding specific threats such as session hijacking, credential theft and insider threats.

Examples of evidence

• Logs showing MFA being used to access network and information systems.
• Configuration of authentication solutions implementing MFA.
• Access control policy outlining how different MFA methods are assigned, including whether phishing-resistant MFA is used.

Requirement

The relevant entities shall ensure that the strength of authentication is appropriate for the classification of the asset to be accessed.

Guidance

• Determine which network and information systems require the use of MFA protection based on the classification of the asset to be accessed. Wherever possible, use phishing-resistant MFA.
• Analyse user roles and the level of access required by each role to determine appropriate MFA methods.
• Consider MFA, in particular when accessing systems from a remote location, accessing system administration systems, access to sensitive information, etc.
• Enforce MFA on internet-facing systems, such as email, remote desktop and VPNs (99).
• Define when and how MFA is required (e.g. every login, once per session or for high-risk actions).

Examples of evidence

• Documentation detailing the classification of assets and the associated requirement for MFA protection.
• Risk assessment results justifying the need for MFA on certain network and information systems.
• List of user roles, associated access rights and the analysis conducted to determine appropriate MFA methods.
• Configuration files and logs showing MFA enabled on specific network and information systems.
• Settings from authentication systems reflecting the defined MFA requirements.
• Logs from authentication systems showing enforcement of these MFA requirements.

Tips: guidance

• Integrate MFA with SSO solutions for seamless access. Wherever possible, use phishing-resistant MFA.
• Implement secure fallback methods for users who lose access to their MFA methods.
• Educate users about the importance of MFA and how to use it.
• Regularly monitor MFA logs for suspicious activity.
• Keep the MFA system and associated devices updated.
• Combine MFA with other techniques to require additional factors under specific circumstances, based on predefined rules and patterns, such as access from an unusual location, from an unusual device or at an unusual time.
• Evaluate and choose an MFA provider that fits the entity’s requirements:
  • ease of integration: ensure the MFA solution integrates well with the existing systems;
  • user experience: aim for a balance between security and user convenience;
  • scalability: choose a solution that can grow with the entity;
  • support and reliability: ensure the provider offers robust support and high reliability.
• Pilot test the MFA solution with a small group of users.
• Ensure that MFA implementation meets legal requirements (e.g. the GDPR).

Tips: examples of evidence

• Manuals, configuration files or screenshots demonstrating the successful integration of MFA with an SSO provider.
• Records of training sessions, attendance lists and training materials provided to users about the importance and usage of MFA.
• Regularly generated reports from MFA systems showing log monitoring activities and any suspicious activities detected.
• Configuration files showing the implementation of additional authentication factors based on predefined rules.