Security fundamentals

What is multi-factor authentication (MFA)?

Multi-factor authentication (MFA) requires two or more independent factors to sign in, typically something you know (a password) plus something you have (a device) or something you are (a biometric), so a stolen password alone is not enough to get in.

Definition

Multi-factor authentication (MFA) is an authentication method that grants access only after a user presents two or more independent factors: knowledge (a password or PIN), possession (a phone, token, or passkey), or inherence (a fingerprint or face).

Background

Passwords alone are weak because they are reused, phished, and guessed. MFA adds a second, independent factor so that a compromised password is not enough on its own. Not all MFA is equal: one-time codes over SMS are better than nothing but can be intercepted or phished, while phishing-resistant methods such as FIDO2 passkeys and hardware security keys are far stronger. Modern guidance (for example NIST SP 800-63) emphasizes MFA, especially for privileged and remote access.

Why it matters

MFA is one of the highest-impact controls a small team can deploy, and it is one auditors look for early. Requiring it on administrative and remote access dramatically reduces the risk of account takeover, the entry point for many breaches.

Step by step

Require MFA for all administrative and remote access first.
Extend MFA to every user and every system that supports it.
Prefer phishing-resistant factors (passkeys or hardware keys) over SMS codes where possible.
Enforce MFA centrally through your identity provider rather than app by app.
Keep recovery and backup options secure so they cannot be used to bypass MFA.

Examples

An admin logs in with a password and approves a prompt on a hardware security key, a phishing-resistant second factor.
A company enforces MFA through its identity provider so a single policy covers every connected application.

Common mistakes

Enabling MFA for regular users but exempting admins, the accounts that matter most.
Relying only on SMS codes, which are susceptible to interception and SIM-swap attacks.
Allowing recovery flows that let an attacker reset MFA with just an email.

FAQ

Is MFA the same as two-factor authentication?

Two-factor authentication (2FA) is MFA with exactly two factors. MFA is the general term for two or more factors, so all 2FA is MFA, but MFA can include more than two.

Does SOC 2 or ISO 27001 require MFA?

Neither names MFA as a single mandatory item, but both expect strong access controls, and auditors routinely look for MFA on privileged and remote access as standard practice.

What makes a good password policy? → What is zero trust? → What is least privilege? →

Do this in Keel, not a spreadsheet

Keel is the AI-native GRC platform for SMBs: one control-and-evidence graph across SOC 2, ISO 27001, HIPAA, PCI DSS, NIST CSF, and more. Start free, no credit card.

Start free