Multi-factor authentication (MFA) is an electronic authentication method that requires a user to present two or more pieces of evidence (or factors) to an authentication mechanism. The factors can be something the user knows (such as a password or a PIN), something the user has (such as a smartphone or a security token), or something the user is (such as a fingerprint or a facial recognition). MFA enhances the security of online accounts and applications by making it harder for attackers to gain access with stolen or guessed credentials.
MFA is recommended as a best practice for third-party risk management, as it can reduce the risk of unauthorized access, data breaches, and identity theft. MFA is also a requirement for some regulatory standards and frameworks, such as PCI DSS, HIPAA, and NIST 800-63. References:
* What is: Multifactor Authentication
* Set up your Microsoft 365 sign-in for multi-factor authentication
* Multi-factor authentication - Wikipedia
* Shared Assessments CTPRP Study Guide, page 19
* Shared Assessments CTPRP Job Guide, page 14
* Best Practices Guidance for Third Party Risk, page 9