Essential Eight · Multi-factor authentication
ISM-1892
Multi-factor authentication is used to authenticate human users to their organisation’s online customer services that…
frameworkASD Essential Eight
sectionMulti-factor authentication
levelsML1, ML2, ML3
csf 2.0PR.AA-03
topics—
frameworks0 0 2
Official textMulti-factor authentication is used to authenticate human users to their organisation’s online customer services that process, store or communicate their organisation’s sensitive customer data.Australian Signals Directorate, Information Security Manual (September 2026). © Commonwealth of Australia, CC BY 4.0
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | PR.AA-03 | Users, services, and hardware are authenticated | No mapping. Only shares CSF PR.AA-03: related, not a mapping | |
| ISO 27001 | A.5.15A.5.16A.5.17A.5.18 | Access control; Identity management… | No mapping. Only shares CSF PR.AA-03: related, not a mapping+1 more loosely related (not mappings) | |
| CIS v8.1 | CIS 6.3CIS 6.4CIS 6.5CIS 12.7 | Require MFA for Externally-Exposed Applications; Require MFA for Remote Network Access… | No mapping. Only shares CSF PR.AA-03: related, not a mapping+3 more loosely related (not mappings)CIS 16.10 Apply Secure Design Principles in Application Architectures Only shares CSF PR.AA-03: related, not a mapping | |
| SOC 2 | CC6.1CC6.6 | Logical access security over information assets; Protection against threats from outside system boundaries | No mapping. Only shares CSF PR.AA-03: related, not a mapping | |
| PCI DSS | 2.2.22.3.13.5.1.36.2.4 | Vendor default accounts managed or removed; Wireless vendor defaults changed… | No mapping. Only shares CSF PR.AA-03: related, not a mapping+13 more loosely related (not mappings)8.3.1 User and admin access requires an authentication factor Only shares CSF PR.AA-03: related, not a mapping …and 9 more in the downloads | |
| CMMC | AC.L2-3.1.8AC.L2-3.1.11IA.L2-3.5.1IA.L2-3.5.2 | Unsuccessful Logon Attempts; Session Termination… | No mapping. Only shares CSF PR.AA-03: related, not a mapping+6 more loosely related (not mappings)…and 2 more in the downloads | |
| 800-53 | AC-7AC-12IA-2IA-2(1) | Unsuccessful Logon Attempts; Session Termination… | No mapping. Only shares CSF PR.AA-03: related, not a mapping+9 more loosely related (not mappings)IA-2(2) Multi-factor Authentication to Non-privileged Accounts Only shares CSF PR.AA-03: related, not a mapping …and 5 more in the downloads | |
| HIPAA | §164.310(b)§164.312(a)(2)(i)§164.312(a)(2)(iii)§164.312(d) | Workstation Use; Unique User Identification… | No mapping. Only shares CSF PR.AA-03: related, not a mapping | |
| GDPR | — | No requirement | No mapping in our data | No mapping in our data (only GDPR's security articles are mapped, editorially). |
| NIS2 | 11.611.7 | Authentication; Multi-factor authentication | No mapping. Only shares CSF PR.AA-03: related, not a mapping | |
| DORA | Art.9(4)(d) | Protection and prevention | No mapping. Only shares CSF PR.AA-03: related, not a mapping | |
| CPS 234 | — | No requirement | No mapping in our data | No mapping in our data (CPS 234 is principles-based and its links are editorial). |
| Cyber Essentials | CE 4 | User Access Control | No mapping. Only shares CSF PR.AA-03: related, not a mapping |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.