保护 (PR) · 主题
多因素认证
要求访问时使用多种认证因素。
多因素认证由 NIST CSF 2.0 成果 PR.AA-03 (Users, services, and hardware are authenticated) 定义。 对照映射 通过 ISO 27001, CMMC, 800-53 和 NIS2 中已发布的对照表完成映射。 编辑说明 在 CIS v8.1, SOC 2, PCI DSS, Essential Eight, DORA 和 Cyber Essentials 中经编辑映射。 在 HIPAA 中仅弱相关。 本站数据中无映射 本站数据中 GDPR 和 CPS 234 无映射。
| 框架 | 要求 | 标题 | 链接 | 来源 / 原因 |
|---|---|---|---|---|
| NIST CSF 2.0 | PR.AA-03 | Users, services, and hardware are authenticated | 主题定义 | PR.AA-03 |
| ISO 27001 | A.8.5 | Secure authentication | 对照映射 | A.8.5: via PR.AA-03 |
| CIS v8.1 | CIS 6.3CIS 6.4CIS 6.5 | Require MFA for Externally-Exposed Applications; Require MFA for Remote Network Access; Require MFA for Administrative Access | 编辑说明 | CIS 6.3: MFA for externally-exposed applications; not in CIS's own crosswalk to CSF 2.0, which covers 49 of 153 safeguards. CIS 6.4: MFA for remote network access; not in CIS's own crosswalk to CSF 2.0, which covers 49 of 153 safeguards. CIS 6.5: MFA for administrative access; not in CIS's own crosswalk to CSF 2.0, which covers 49 of 153 safeguards. |
| SOC 2 | CC6.1 | Logical access security over information assets | 编辑说明 | CC6.1: AICPA's TSC mappings are not openly licensed; ControlMapping editorial mapping (criterion summaries are ours, not AICPA text). |
| PCI DSS | 8.4.18.4.28.4.38.5.1 | MFA for non-console administrative access to the CDE; MFA for all access into the CDE; MFA for remote network access… | 编辑说明 | 8.4.1: PCI DSS's MFA requirement for administrative CDE access; NIST's PCI references for PR.AA-03 omit 8.4.x. 8.4.2: MFA for all CDE access; omitted from NIST's PCI references for PR.AA-03. 8.4.3: MFA for remote network access; omitted from NIST's PCI references for PR.AA-03. 8.5.1: MFA system configuration; omitted from NIST's PCI references for PR.AA-03. |
| CMMC | IA.L2-3.5.3 | Multifactor Authentication | 对照映射 | IA.L2-3.5.3: via 800-171r3 03.05.03 ↔ PR.AA-03 → IA-2; 800-171r2 Appendix D → IA-2 |
| 800-53 | IA-2(1)IA-2(2) | Multi-factor Authentication to Privileged Accounts; Multi-factor Authentication to Non-privileged Accounts | 对照映射 | IA-2(1): via PR.AA-03 IA-2(2): via PR.AA-03 |
| HIPAA | §164.310(b)§164.312(a)(2)(i)§164.312(a)(2)(iii)§164.312(d) | 未映射到此主题 | 这些要求仅通过已发布的交叉映射与本主题的 CSF 成果（PR.AA-03）存在关联：值得核查，但不构成映射。 | |
| GDPR | — | 无要求 | 本站数据中无映射 | 本站数据中没有 GDPR 要求映射到此主题。 |
| NIS2 | 11.611.7 | Authentication; Multi-factor authentication | 对照映射 | 11.6: via PR.AA-03 11.7: via PR.AA-03; ENISA ISO map: A.8.5 |
| Essential Eight | ISM-1504ISM-1679ISM-1173ISM-0974ISM-1401ISM-1872 | Multi-factor authentication is used to authenticate human users to their organisation’s online services that process…; Multi-factor authentication is used to authenticate human users to third-party online services that process, store or…; Multi-factor authentication is used to authenticate privileged human users of systems… | 编辑说明 | ASD assigns these ISM controls to the Essential Eight; ASD publishes no crosswalk to NIST or ISO, so linking them to topics is ControlMapping editorial. |
| DORA | Art.9(4)(d) | Protection and prevention | 编辑说明 | Art.9(4)(d): Strong authentication mechanisms based on relevant standards; the technical standards set out the detail. |
| CPS 234 | — | 无要求 | 本站数据中无映射 | 本站数据中没有 CPS 234 要求映射到此主题。 |
| Cyber Essentials | CE 4 | User Access Control | 编辑说明 | CE 4: Multi-factor authentication wherever it is available, and always for cloud services. |
主题定义 定义本主题的 CSF 2.0 结果 · 对照映射 至少一项选择有已发布对照表作为依据 · 编辑说明 ControlMapping 的判断及理由 · 未映射，仅与该主题的 CSF 成果相同 · 本站数据中无映射 我们的数据中未映射任何内容；通常为新工作，但请查看覆盖范围说明. 方法说明.
要求编号和标题均按各框架官方发布的英文原文显示。
映射有误或缺失？ 报告
关于多因素认证
多因素认证（MFA）要求用户出示两种或以上的验证因素，通常结合用户所知（密码）、所持（硬件令牌或移动设备）以及自身特征（生物识别），从而大幅降低账户被攻陷的风险。如今，MFA已被视为几乎所有合规框架的基线安全要求，对特权账户、远程访问和云服务认证尤为关键。NIST（SP 800-63B）和CISA的指导意见更倾向于采用具备抗钓鱼能力的方法，例如FIDO2安全密钥和通行密钥，而非可能被截获的短信验证码；Essential Eight则要求在更高成熟度级别采用更强的认证方法。