Habit 08 of 18
Accounts and access
Multi-factor authentication
Email and key systems ask for a second step, such as an app code, at sign-in.
A second sign-in step stops most account takeovers, even when a password has leaked.
Switch it on in the map Counts towards 6 articles, controls and categories
§1 How to do it
How a small firm does it
- Turn on two-step sign-in for email first, then for every system that offers it.
- Prefer an authenticator app or a security key to text messages.
- Make it required, not optional, and keep a list of any exceptions with a reason.
Evidence that shows it
- A screenshot of the policy in your email or identity admin console
- A list of systems where it is on, and any exceptions
Ireland: NCSC Ireland guidance on authentication applies here. Irish NIS2 law is still pending.
§2 What it counts towards
What it counts towards
Most links are “supports”: doing this helps you show you meet the reference, without matching it exactly. None of them means “compliant”.
EU NIS2 Directive 2 items
-
21(2)(i) People security, access control and assets · supports
human resources security, access control policies and asset management
Access control is named in this measure. The Commission’s implementing rules for it include multi-factor authentication (2024/2690, Annex §11.7).
Read Art 21(2)(i) on EUR-Lex -
21(2)(j) Multi-factor authentication and secure communications · subset
the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate.
Multi-factor authentication is named directly in this measure, which also covers secured voice, video and text communications. The measure applies where appropriate.
Read Art 21(2)(j) on EUR-Lex
General Data Protection Regulation 1 item
-
32(1)(b) Ongoing confidentiality, integrity and resilience · supports
the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services
A second sign-in step blocks most account takeovers, which helps keep systems confidential.
Read Art 32(1)(b) on EUR-Lex
ISO/IEC 27001:2022 2 items
-
A.5.17 Looking after passwords and other secrets · supports
ISO text is copyrighted. Control number and our own description only. Not yet read against the standard.
Protecting sign-in secrets is part of this control. A second factor reduces the harm of a stolen password.
About ISO/IEC 27001:2022 on ISO -
A.8.5 Secure sign-in · supports
ISO text is copyrighted. Control number and our own description only. Not yet read against the standard.
The control is about secure ways of signing in. Multi-factor authentication is a common example.
About ISO/IEC 27001:2022 on ISO
NIST Cybersecurity Framework 2.0 1 item
-
PR.AA Identity and access · supports
PR.AA-03: Users, services, and hardware are authenticated
This outcome is about authenticating users. A second factor makes that authentication much stronger.
Read PR.AA-03 on NIST
§3 Questions it answers
Indicative mapping, written by hand from public sources. Not legal advice and not a compliance test. Check anything important against the official texts.