Multi-factor Authentication (MFA)

Intent of this Standard

Organisations have a duty of care to ensure their critical and sensitive information is adequately protected and that requests to access, modify, transmit, or delete information are to authorised personnel only.

It is important that organisations have put in place appropriate multi-layered preventive and protective measures, beyond conventional username and password authentication requirements. This will further bolster resilience levels, should the first level of authentication be compromised.

Authentication factors can be broadly defined as having the following attributes and characteristics:

• Knowledge factor
• Possession factor
• Inherence factor

MFA verifies a user’s identity using multiple credentials, which may be of the same factor or type.

Minimum capability maturity level

We have established criteria within a maturity model to provide clarity, including the expected minimum implementation level, which is CS-CMM 2.

Cyber Security Capability Maturity Model

The requirements are intended to meet and comply with each respective level of maturity. The levels provide a pathway that can be used by agencies to assess themselves against, with a view to improving maturity over time.

Each maturity level builds on the requirement from the preceding level.

Below are the requirements for each capability maturity level for this Standard.

Focus areas

Focus areas are applicable to the Standard and are provided as a guide and not an exhaustive list. Each agency is best placed to identify areas of relevance.

The focus areas for this Standard are:

• Cloud services
• Remote access
• Standard user accounts
• Privileged user accounts
• Core network access.

Suggested actions

The following list is not exhaustive. Organisations should identify which actions are appropriate to implement the Standard based on their current maturity level. However, the following actions follow good practice guidelines:

• Organisations undertake an asset classification exercise to identify their business-critical and sensitive systems.
• Organisations decide on an MFA delivery option and costings.
•  Where possible, include MFA within the Identity Provider (IdP) platform using Single Sign-On (SSO).
• Training, documentation, support, and user acceptance procedures are developed and delivered.

Key dependencies

To implement this Standard, there are likely to be requisite measures or technologies in place.

A number of dependencies apply to multiple standards. In general, these dependencies are less technology-specific and relate to business processes.

Key dependencies for this Standard include:

• An up-to-date understanding of critical business and internet-facing systems and roles.
• Availability of hardware (for example, organisation-issued key fobs, 
  YubiKey).
• Availability of authenticators (e.g. tokens, smart cards).
• Software (e.g. Google or Microsoft Authenticator).
• Biometrics (e.g. thumbprint, facial recognition).
• Monitoring, logging, and alerting functionality/capability exists.
• User acceptance of user agreements is in place.
• Development and ongoing delivery of user awareness/training material has been created.

Measurable outcomes

To establish whether the Standard is being implemented, the outcomes are a tool an organisation may wish (or already have in place) to measure to help make this determination.

The outcomes have been designed to align with the requirements contained in the maturity level.

Outcomes for this Standard include:

• MFA is implemented for business-critical and internet-facing systems, and for privileged accounts.
• Funding for MFA monitoring, alerting, and operational management is included in budgets.
• Monitoring/logging to track operational performance, or for security-related events, is in place.
• Inventory or asset listing of MFA hardware.
• Evidence of security testing and/or other forms of assurance that the MFA system is secure.
• A lifecycle management process for MFA tokens, including resetting of privileged user tokens, has been developed.