11.7.1 The relevant entities shall ensure that users are authenticated by multiple authentication factors …

Requirement

The relevant entities shall ensure that users are authenticated by multiple authentication factors or continuous authentication mechanisms for accessing the entities’ network and information systems, where appropriate, in accordance with the classification of the asset to be accessed.

Guidance

• Select appropriate MFA (97) methods and continuous authentication mechanisms based on the entity’s security needs and depending on the classification of the asset. It is also good practice to consider user convenience when selecting and implementing a solution:
  • test-message-based OTP: simple but less secure due to risks such as SIM swapping;
  • authenticator apps: generate time-based OTPs;
  • push notifications: send an approval request to a user’s device;
  • hardware tokens: for example physical devices generating OTPs, smart cards;
  • passkeys;
  • Fast Identity Online 2 security keys;
  • biometrics: fingerprints, facial recognition, etc.
  • Consider continuous authentication (98) for avoiding specific threats such as session hijacking, credential theft and insider threats.

Examples of evidence

• Logs showing MFA being used to access network and information systems.
• Configuration of authentication solutions implementing MFA.
• Access control policy outlining how different MFA methods are assigned, including whether phishing-resistant MFA is used.

1. Pregled

1.1 Sklici

1.2 Ugotovljene zahteve

1.3 Povezani predpisi

2. Ugotovljene zahteve

3. Povezani predpisi

Povezane zadeve

• ENISA -

  EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

  DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.