A mitigation strategy in the ASD Essentials (currently the Essential Eight), assessed against 7 tests at Maturity Level One.
MFA asks for a second proof of identity beyond a password, so a stolen or guessed password is not enough to get in on its own.
Why it matters
Password reuse and phishing are how most breaches begin. MFA is the highest-value strategy you can turn on quickly, and it is increasingly expected by insurers and contract conditions.
How Conformance helps
- Require MFA for all staff, not just administrators
- Apply MFA to remote access, webmail and any internet-facing system
- Prefer phishing-resistant methods over SMS where you can
- Enforce MFA for privileged and vendor accounts without exception
- Keep enrolment and enforcement reports as evidence
How Conformance helps
Conformance validates this strategy from the evidence your organisation already produces, shows your maturity level, and tells you the next step to raise it.
Official guidance: ASD Essential Eight Maturity Model