Multi-Factor Authentication
A security mechanism that requires users to provide two or more independent verification factors before granting access to a system or resource. Factors typically include something you know (password), something you have (token or device), and something you are (biometric).
Multi-factor authentication (MFA) significantly strengthens identity verification by requiring multiple independent credentials from different categories. The three classical factor categories are knowledge factors (passwords, PINs), possession factors (hardware tokens, smartphones, smart cards), and inherence factors (fingerprints, facial recognition, voice patterns). By combining factors from different categories, MFA ensures that compromising a single credential is insufficient for unauthorized access.
MFA is a cornerstone of modern security architecture and is referenced across every major compliance framework. ISO 27001 Annex A control A.8.5 addresses secure authentication, with MFA being the expected standard for privileged and remote access. SOC 2 Trust Services Criteria require logical access controls that commonly include MFA for system components. GDPR Article 32 mandates appropriate technical measures to protect personal data, and regulators increasingly view MFA as a baseline expectation. NIS2 explicitly references multi-factor authentication as a minimum cybersecurity measure for essential and important entities.
Implementing MFA effectively goes beyond simply enabling a second factor. Organizations must consider which authentication methods to support (TOTP apps, hardware security keys, push notifications, SMS — with SMS being the least secure option), how to handle account recovery when a factor is lost, and how to balance security with user experience. Adaptive or risk-based MFA can adjust authentication requirements based on contextual signals such as location, device, and behavior patterns. For SaaS products, offering MFA to end users is often a customer expectation and a competitive differentiator, particularly for enterprise clients who may require it as part of their own compliance obligations.
Related frameworks
Related terms
Access Control
The set of policies, procedures, and technical mechanisms that govern who can access which information assets, systems, and resources. Access control ensures that only authorized individuals can view, modify, or interact with sensitive data and systems.
Identity and Access Management
The framework of policies, processes, and technologies that manages digital identities and controls user access to critical systems and data. IAM encompasses identity lifecycle management, authentication, authorization, single sign-on, directory services, and privileged access management.
Role-Based Access Control
An authorization model that assigns permissions to users based on their organizational roles rather than individual identities. RBAC simplifies access management by grouping permissions into roles such as administrator, editor, or viewer, and assigning users to the appropriate roles.
Zero Trust Architecture
A security model that eliminates implicit trust based on network location and instead requires continuous verification of every user, device, and request before granting access to any resource, operating on the principle of 'never trust, always verify.'
Assess your compliance posture
Run a free self-assessment for ISO 27001, SOC 2, GDPR, NIS2, or Tech DD and see exactly where you stand.
Start free assessment