Australian Information Security Manual ISM-1919: When multi-factor authentication is used to authenticate users or customers to online serv

When multi-factor authentication is used to authenticate users or customers to online services or online customer services, all other authentication protocols that do not support multi-factor authentication are disabled.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Guidelines for system hardening

ISM-0341 Automatic execution features for removable media are disabled.
ISM-0343 If there is no business requirement for writing to removable media and devices, such funct
ISM-0345 External communication interfaces that allow DMA are disabled.
ISM-0380 Unneeded user accounts, components, services and functionality of operating systems are di
ISM-0382 Unprivileged users do not have the ability to uninstall or disable approved applications.
ISM-0383 Default user accounts or credentials for operating systems, including for any pre-configur
ISM-0408 Systems have a logon banner that reminds users of their security responsibilities when acc
ISM-0417 When systems cannot support multi-factor authentication, single-factor authentication usin

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Australian Information Security Manual controls