SMS verification codes
SMS verification codes are one-time numbers sent to your mobile phone by text message, which you type in after your password to prove it is you. Cyber Essentials accepts SMS as MFA. The requirements say SMS 'is not the most secure type of MFA' but is far better than none, and recommend alternatives where they work for you.
- Term
- SMS verification codes
- Also known as
- Text message codes, SMS one-time passcodes, SMS OTP, SMS MFA
- Category
- Accounts and access
- Requirement area
- 4. User Access Control
- Questions
- A7.14A7.16AUTO-FAILA7.17AUTO-FAIL
- Reviewed against
- Requirements v3.3
What does the term SMS verification codes mean in Cyber Essentials?
SMS verification codes are one-time numbers sent to your mobile phone by text message, which you type in after your password to prove it is you.
SMS is not the most secure type of MFA but still offers a huge advantage over not using any MFA at all. Any multi-factor authentication is better than not having it at all.
How does SMS verification codes apply to Cyber Essentials?
In plain terms
You type your password, and a few seconds later a text arrives with a six-digit number. You type that in too. It is the same idea as a bank texting you a code before a payment. It works on almost any phone, which is why it is so widely offered.
What Cyber Essentials asks
SMS counts. The NCSC requirements put it plainly in the wording quoted above, then add: "if there are alternatives available that will work for your situation, we recommend you use these instead of SMS." The requirements list one-time codes "sent via email, SMS, or a mobile app" among passwordless methods, and A7.14's guidance gives "a text message" as an example of MFA.
What matters most for the question set is that MFA is on. A7.16 asks whether MFA is applied to all administrators of your cloud services and A7.17 to all users. A No to either is an automatic fail, whichever type of MFA you use.
Why alternatives are recommended
A text message depends on your mobile number, and a number can be moved to another SIM if a criminal persuades a mobile network to transfer it. An authenticator app, a passkey or a physical security key is tied to a device instead. For administrator accounts in particular, it is worth using one of those where the service supports it.
See does SMS count as MFA and A7.16. Related: multi-factor authentication, authenticator app, FIDO2.
Related terms
- Multi-factor authentication (MFA)Multi-factor authentication (MFA) is a method of authenticating a user which uses two or more verification factors.
- Authenticator appAn authenticator app is a phone app that confirms it is really you logging in, either by showing a short code that changes every few seconds or by asking you to tap to approve.
- FIDO2FIDO2 is a set of open standards for signing in with a cryptographic key held on your device or on a physical security key, instead of typing a password.
- Standard user accountA standard user account is an everyday login that can run programs and open files but cannot install software or change system-wide settings without an administrator's approval.
- ThrottlingThrottling is a setting that makes you wait longer after each wrong password or PIN, so guessing becomes slow enough to be pointless.
- User accountA user account is the named login, usually a username plus a password or other credential, that lets one person into a computer, phone or online service.
Frequently asked questions
SMS verification codes are one-time numbers sent to your mobile phone by text message, which you type in after your password to prove it is you. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, SMS verification codes comes up at A7.14, A7.16, A7.17. Read those questions against the definition above so your answers use the term the way the assessor will.
SMS verification codes relates to 4. User Access Control in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.