Essential Eight · strategy 3 of 8
Multi-factor authentication
Require MFA for online services, remote access and privileged users, extending to data repositories and phishing-resistant methods at higher levels. The tables list the ISM controls ASD tags for this strategy at each maturity level; a level is reached only when every requirement at that level and below is met.
Patch applications · Patch operating systems · Multi-factor authentication · Restrict administrative privileges · Application control · Restrict Microsoft Office macros · User application hardening · Regular backups
Maturity Level One · 7 controls
| ISM control | Requirement (ASD's text) | Levels | Mapped to (ISO 27001, SOC 2, NIST CSF) |
|---|---|---|---|
| ISM-1401 | Multi-factor authentication uses either: something people have and something people know, or something people have that is unlocked by something people know or are. | ML1, ML2, ML3 | A.8.5 CC6.1 PR.AA-03 |
| ISM-1504 | Multi-factor authentication is used to authenticate human users to their organisation’s online services that process, store or communicate their organisation’s sensitive data. | ML1, ML2, ML3 | A.8.5 CC6.1 PR.AA-03 |
| ISM-1679 | Multi-factor authentication is used to authenticate human users to third-party online services that process, store or communicate their organisation’s sensitive data. | ML1, ML2, ML3 | A.8.5 CC6.1 PR.AA-03 |
| ISM-1680 | Multi-factor authentication (where available) is used to authenticate human users to third-party online services that process, store or communicate their organisation’s non-sensitive data. | ML1, ML2, ML3 | — |
| ISM-1681 | Multi-factor authentication is used to authenticate customers to online customer services that process, store or communicate sensitive customer data. | ML1, ML2, ML3 | — |
| ISM-1892 | Multi-factor authentication is used to authenticate human users to their organisation’s online customer services that process, store or communicate their organisation’s sensitive customer data. | ML1, ML2, ML3 | — |
| ISM-1893 | Multi-factor authentication is used to authenticate human users to third-party online customer services that process, store or communicate their organisation’s sensitive customer data. | ML1, ML2, ML3 | — |
Maturity Level Two · 13 controls
| ISM control | Requirement (ASD's text) | Levels | Mapped to (ISO 27001, SOC 2, NIST CSF) |
|---|---|---|---|
| ISM-0974 | Multi-factor authentication is used to authenticate unprivileged human users of systems. | ML2, ML3 | A.8.5 CC6.1 PR.AA-03 |
| ISM-1173 | Multi-factor authentication is used to authenticate privileged human users of systems. | ML2, ML3 | A.8.5 CC6.1 PR.AA-03 |
| ISM-1401 | Multi-factor authentication uses either: something people have and something people know, or something people have that is unlocked by something people know or are. | ML1, ML2, ML3 | A.8.5 CC6.1 PR.AA-03 |
| ISM-1504 | Multi-factor authentication is used to authenticate human users to their organisation’s online services that process, store or communicate their organisation’s sensitive data. | ML1, ML2, ML3 | A.8.5 CC6.1 PR.AA-03 |
| ISM-1679 | Multi-factor authentication is used to authenticate human users to third-party online services that process, store or communicate their organisation’s sensitive data. | ML1, ML2, ML3 | A.8.5 CC6.1 PR.AA-03 |
| ISM-1680 | Multi-factor authentication (where available) is used to authenticate human users to third-party online services that process, store or communicate their organisation’s non-sensitive data. | ML1, ML2, ML3 | — |
| ISM-1681 | Multi-factor authentication is used to authenticate customers to online customer services that process, store or communicate sensitive customer data. | ML1, ML2, ML3 | — |
| ISM-1682 | Multi-factor authentication used for authenticating human users of systems is phishing-resistant. | ML2, ML3 | — |
| ISM-1683 | Successful and unsuccessful multi-factor authentication events are centrally logged. | ML2, ML3 | A.8.15 CC7.2 DE.AE-03 |
| ISM-1872 | Multi-factor authentication used for authenticating human users of online services is phishing-resistant. | ML2, ML3 | A.8.5 CC6.1 PR.AA-03 |
| ISM-1873 | Multi-factor authentication used for authenticating customers of online customer services provides a phishing-resistant option. | ML2 | — |
| ISM-1892 | Multi-factor authentication is used to authenticate human users to their organisation’s online customer services that process, store or communicate their organisation’s sensitive customer data. | ML1, ML2, ML3 | — |
| ISM-1893 | Multi-factor authentication is used to authenticate human users to third-party online customer services that process, store or communicate their organisation’s sensitive customer data. | ML1, ML2, ML3 | — |
Maturity Level Three · 15 controls
| ISM control | Requirement (ASD's text) | Levels | Mapped to (ISO 27001, SOC 2, NIST CSF) |
|---|---|---|---|
| ISM-0974 | Multi-factor authentication is used to authenticate unprivileged human users of systems. | ML2, ML3 | A.8.5 CC6.1 PR.AA-03 |
| ISM-1173 | Multi-factor authentication is used to authenticate privileged human users of systems. | ML2, ML3 | A.8.5 CC6.1 PR.AA-03 |
| ISM-1401 | Multi-factor authentication uses either: something people have and something people know, or something people have that is unlocked by something people know or are. | ML1, ML2, ML3 | A.8.5 CC6.1 PR.AA-03 |
| ISM-1504 | Multi-factor authentication is used to authenticate human users to their organisation’s online services that process, store or communicate their organisation’s sensitive data. | ML1, ML2, ML3 | A.8.5 CC6.1 PR.AA-03 |
| ISM-1505 | Multi-factor authentication is used to authenticate human users of data repositories. | ML3 | — |
| ISM-1679 | Multi-factor authentication is used to authenticate human users to third-party online services that process, store or communicate their organisation’s sensitive data. | ML1, ML2, ML3 | A.8.5 CC6.1 PR.AA-03 |
| ISM-1680 | Multi-factor authentication (where available) is used to authenticate human users to third-party online services that process, store or communicate their organisation’s non-sensitive data. | ML1, ML2, ML3 | — |
| ISM-1681 | Multi-factor authentication is used to authenticate customers to online customer services that process, store or communicate sensitive customer data. | ML1, ML2, ML3 | — |
| ISM-1682 | Multi-factor authentication used for authenticating human users of systems is phishing-resistant. | ML2, ML3 | — |
| ISM-1683 | Successful and unsuccessful multi-factor authentication events are centrally logged. | ML2, ML3 | A.8.15 CC7.2 DE.AE-03 |
| ISM-1872 | Multi-factor authentication used for authenticating human users of online services is phishing-resistant. | ML2, ML3 | A.8.5 CC6.1 PR.AA-03 |
| ISM-1874 | Multi-factor authentication used for authenticating customers of online customer services is phishing-resistant. | ML3 | — |
| ISM-1892 | Multi-factor authentication is used to authenticate human users to their organisation’s online customer services that process, store or communicate their organisation’s sensitive customer data. | ML1, ML2, ML3 | — |
| ISM-1893 | Multi-factor authentication is used to authenticate human users to third-party online customer services that process, store or communicate their organisation’s sensitive customer data. | ML1, ML2, ML3 | — |
| ISM-1894 | Multi-factor authentication used for authenticating human users of data repositories is phishing-resistant. | ML3 | — |
Applies to every strategy
Logging and incident controls that ASD repeats under each strategy.
ML2: ISM-0123 ISM-0140 ISM-1228 ISM-1815 ISM-1819 ISM-1906
ML3: ISM-0109 ISM-0123 ISM-0140 ISM-1228 ISM-1815 ISM-1819 ISM-1906 ISM-1907
Control text: Australian Signals Directorate, Information Security Manual (September 2026). © Commonwealth of Australia, CC BY 4.0. Links to other frameworks are ControlMapping editorial (ASD publishes no crosswalk). Essential Eight guide · Gap analysis → Essential Eight