MFA Requirements Compared Across 11 Frameworks

Everyone agrees MFA matters, but the frameworks disagree about where it is mandatory, for which users and how strong it must be. Here is the comparison, with the requirement IDs.

This post covers the 11 frameworks ControlMapping mapped when it was written. Since then, DORA, CPS 234, Cyber Essentials were added on 2026-10-27; their pages and the coverage matrix include them.

Multi-factor authentication is the single control most often cited after a breach: "the account didn't have MFA." It's also a control where frameworks differ sharply. Some name MFA explicitly for specific users and access paths; others require "secure authentication" and leave the method to your risk assessment. One doesn't mention it at all.

Who requires what

Framework	Multi-Factor Auth	Link
NIST CSF 2.0	PR.AA-03	Topic definition
ISO 27001	A.8.5	Crosswalk
CIS v8.1	CIS 6.3 CIS 6.4 CIS 6.5	Editorial
SOC 2	CC6.1	Editorial
PCI DSS	8.4.1 8.4.2 8.4.3 8.5.1	Editorial
CMMC	IA.L2-3.5.3	Crosswalk
800-53	IA-2(1)IA-2(2)	Crosswalk
HIPAA	—	Loosely related
GDPR	—	No mapping in our data
NIS2	11.6 11.7	Crosswalk
Essential Eight	ISM-1504 ISM-1679 ISM-1173 ISM-0974 ISM-1401 ISM-1872	Editorial

Full detail and the reason for every link: Multi-Factor Auth across frameworks →

The explicit requirements

PCI DSS v4.0.1 is the most specific. MFA for all non-console administrative access into the cardholder data environment (8.4.1), for all access into the cardholder data environment (8.4.2), and for remote network access (8.4.3). Since 31 March 2025, 8.4.2 applies to all users, not just administrators. 8.5.1 adds requirements on how the MFA system itself is configured, for example against replay and bypass.
CMMC Level 2 (IA.L2-3.5.3) requires MFA for local and network access to privileged accounts and for network access to non-privileged accounts.
NIST SP 800-53 requires MFA for privileged and non-privileged accounts through IA-2(1) and IA-2(2).
CIS Controls v8.1 require MFA for externally exposed applications (6.3), remote network access (6.4) and administrative access (6.5).
NIS2's Implementing Regulation (point 11.7) requires multi-factor or continuous authentication where appropriate, in line with the classification of the systems accessed. The directive itself lists MFA among the Article 21 measures.
The Essential Eight has MFA as one of its eight strategies, with requirements that extend at each maturity level: from online services and remote access at Level One, through privileged users and data repositories, to phishing-resistant MFA at the higher levels.

The implicit ones

ISO 27001 requires secure authentication (A.8.5), and its guidance in ISO/IEC 27002 points to MFA for important systems, but the standard leaves the choice to your risk treatment. SOC 2 has no MFA criterion; auditors look at it under logical access (CC6.1), and in practice most expect it for remote and privileged access. HIPAA's current Security Rule requires person or entity authentication (§164.312(d)) without specifying how; HHS proposed in January 2025 to require MFA. GDPR asks for security appropriate to the risk and names no specific controls.

Photograph of a small hardware security key on a keyring beside a face-down smartphone on a wooden desk — Phishing-resistant authenticators are where the strictest frameworks are heading.

Where frameworks are heading: phishing resistance

The direction of travel is clear. NIST's digital identity guidelines (SP 800-63B) and CISA favour phishing-resistant authenticators, such as FIDO2 security keys and passkeys, over one-time codes sent by SMS or app. The Essential Eight builds phishing resistance into its higher maturity levels. If you're choosing an MFA method now, design for the strictest framework you might face: phishing-resistant for administrators and remote access first, then everyone.

Key takeaways

PCI DSS, CMMC, SP 800-53, CIS, NIS2 and the Essential Eight name MFA explicitly.
ISO 27001 and SOC 2 imply it; HIPAA may soon require it.
Design for phishing-resistant MFA now, starting with administrators and remote access.

A practical baseline

MFA everywhere remote: VPN, remote desktop, cloud consoles, email and every externally exposed application.
MFA for every privileged action, including local administrator access where CMMC applies.
MFA for everyone who can reach sensitive data (PCI's "all access into the CDE").
Phishing-resistant methods for administrators now, and for everyone as soon as you can.
Log MFA events and alert on failures and new enrolments.

The Multi-Factor Auth topic page lists every requirement ID with its source, and the gap analysis shows how your current framework's MFA requirements compare with the next one you need.

Questions

Which frameworks explicitly require MFA?

PCI DSS v4.0.1 (8.4.1–8.4.3), CMMC Level 2 (IA.L2-3.5.3), SP 800-53 (IA-2(1) and IA-2(2)), the CIS Controls (6.3–6.5), NIS2's Implementing Regulation (11.7) and the Essential Eight. ISO 27001 and SOC 2 require secure authentication without naming MFA.

Does HIPAA require MFA?

The current Security Rule requires person or entity authentication, not specifically MFA. HHS proposed in January 2025 to require MFA; check whether that has been finalised.

Data as of 2026-10-27: numbers in this post are computed from the current crosswalk and update when it changes. Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Not compliance advice.

MFA requirements compared across 11 security frameworks