Multi-factor authentication (MFA)
Multi-factor authentication (MFA) is a method of authenticating a user which uses two or more verification factors. Under Cyber Essentials v3.3 authentication to cloud services must always use MFA, with a password element of at least 8 characters and no maximum. A No to A7.16 (cloud administrators) or A7.17 (cloud users) is an automatic fail under the Danzell question set.
- Term
- Multi-factor authentication
- Also known as
- MFA, 2FA, Two-factor authentication
- Category
- Accounts and access
- Requirement area
- B. Definitions; 4. User Access Control
- Reviewed against
- Requirements v3.3
What does the term multi-factor authentication mean in Cyber Essentials?
Multi-factor authentication (MFA) is a method of authenticating a user which uses two or more verification factors.
Multi-Factor Authentication (MFA) is a method of authenticating a user which uses two or more verification factors.
How does multi-factor authentication apply to Cyber Essentials?
In plain terms
MFA means a stolen password is not enough on its own. After typing the password, you prove it is you a second way: approving a prompt in an app, tapping a security key, or typing a code from your phone. A criminal who phished the password still lacks the second factor.
What does Cyber Essentials require?
Section B keeps the definition short, as quoted above. The user access control section fills in the detail. MFA must be implemented where available, and "authentication to cloud services must always use MFA." The NCSC also says you "should always use multi-factor authentication to give administrative accounts extra security, and accounts that are accessible from the internet." The password element must be at least 8 characters with no maximum length.
The requirements recognise four types of additional factor:
| Factor type in the requirements | Everyday example |
|---|---|
| A managed or enterprise device | Sign-in allowed only from a company laptop that the identity provider recognises |
| An app on a trusted device | An authenticator app prompt or code on a phone |
| A physically separate token | A USB or NFC security key |
| A known or trusted account | The requirements do not give an example; the NCSC guidance on MFA explains the options |
SMS is accepted, but the requirements say "if there are alternatives available that will work for your situation, we recommend you use these instead of SMS." FIDO2 authenticators are regarded as MFA because user authentication is performed.
Which questions ask about MFA?
- A7.14 asks whether all your cloud services offer MFA. A7.15 lists any that do not, and the guidance warns this "will be an automatic fail if a cloud service listed here does have the option for MFA".
- A7.16 (all cloud administrators) and A7.17 (all cloud users) are automatic fails if answered No.
- A4.3, A5.5 and A7.11 offer MFA as option A for firewall passwords, external services and password quality.
What an assessor looks for
At Cyber Essentials Plus, test case 4 runs on all cloud services. The assessor watches users log in "on an untrusted device or from an incognito browser session" and awards a pass if "the user or administrator [is] prompted for a form of MFA before access is granted". Where several services share one sign-in, the test runs once per authentication service.
Common mistakes
- MFA on for staff but not on the separate admin or break-glass accounts.
- A service listed at A7.15 as having no MFA when it does offer it, perhaps on a higher plan or in its security settings.
- A separate login route, such as an app password or an older protocol, that still accepts a password alone.
See the user access control requirements, CE Plus test 4 and the Microsoft 365 and Entra ID setup guide. Related: authenticator app, SMS verification codes, passkey.
Related terms
- Authenticator appAn authenticator app is a phone app that confirms it is really you logging in, either by showing a short code that changes every few seconds or by asking you to tap to approve.
- SMS verification codesSMS verification codes are one-time numbers sent to your mobile phone by text message, which you type in after your password to prove it is you.
- PasskeyA passkey is a way to sign in without a password: your phone or computer holds a secret digital key, and you unlock it with your fingerprint, face or device PIN.
- PassphraseA passphrase is a password made of several ordinary words strung together, such as three random words, which is long and hard to guess but easy to remember.
- PasswordA password is a secret string of characters that you type to prove you are the person an account belongs to.
- Password managerA password manager is an app that stores all your passwords in one locked, encrypted place and can create strong new ones for you, so you only need to remember one.
Frequently asked questions
Multi-factor authentication (MFA) is a method of authenticating a user which uses two or more verification factors. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, multi-factor authentication comes up at A7.14, A7.15, A7.16, A7.17, A4.3, A5.5. Read those questions against the definition above so your answers use the term the way the assessor will.
Multi-factor authentication relates to B. Definitions; 4. User Access Control in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.