Multi-factor authentication

Multi-factor authentication (MFA) requires users to provide two or more verification factors to gain access to a resource. Frameworks mandate this because password theft is a primary attack vector; MFA ensures that compromised credentials alone are insufficient for unauthorized entry.

Counts toward

SOC 2 ISO 27001 PCI DSS HIPAA NIS2 DORA NIST CSF 2.0

Implement it once

Enforce MFA on all remote access gateways, including VPNs and virtual desktops.
Require MFA for all privileged accounts, such as domain administrators, cloud global admins, and root users.
Apply MFA to critical SaaS applications and sensitive internal systems containing PII or intellectual property.
Standardize on a single Identity Provider (IdP) to ensure consistent enforcement across the environment.
Disable legacy authentication protocols that allow users to bypass MFA prompts.

Evidence it produces

Configuration screenshots showing MFA is set to "Required" or "Enforced" for all targeted groups.
Exported user lists from the IdP confirming that active accounts have a registered second factor.
System logs demonstrating successful MFA challenges and rejected attempts.
A formal access control policy explicitly mandating MFA for remote, administrative, and sensitive access.

Where it counts

Most security frameworks require strong authentication for privileged and remote access to mitigate risk. By implementing one centralized MFA solution, an organization satisfies the core intent of these requirements across multiple certifications simultaneously.