CIS Controls v8 CIS-6.3: Require MFA for Externally-Exposed Applications

What else in your programme already covers this

This control maps to 51 controls across 25 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

FedRAMP High · 6 controls

IA-2 Identification and Authentication (Organizational Users)
IA-2(2) MFA to Non-Privileged Accounts
IA-2(6) Identification and Authentication (Organizational Users) | Access to Accounts: separate Device (IA-2(6))
IA-2(8) Access to Accounts Replay Resistant
IA-6 Authentication Feedback
IA-8 Identification and Authentication (Non-Organizational Users)

FedRAMP Moderate · 6 controls

IA-2 Identification and Authentication (Organizational Users)
IA-2(2) MFA to Non-Privileged Accounts
IA-2(6) Identification and Authentication (Organizational Users) | Access to Accounts: separate Device (IA-2(6))
IA-2(8) Access to Accounts Replay Resistant
IA-6 Authentication Feedback
IA-8 Identification and Authentication (Non-Organizational Users)

PCI DSS 4.0 · 5 controls

8.3.1 8.3.1 Access authenticated with at least one factor
8.3.3 8.3.3 Identity verified before factor changes
8.4.2 8.4.2 MFA for all non-console CDE access
8.4.3 8.4.3 MFA for remote access that could reach CDE
8.5.1 8.5.1 MFA system resistant to replay and bypass

NIST SP 800-53 Rev 5 · 4 controls

NIST800-IA-1 IA-1 Policy and Procedures
NIST800-IA-2 IA-2 Identification and Authentication (Organizational Users)
NIST800-IA-8 IA-8 Identification and Authentication (Non-organizational Users)
SP800-53-IA Identification and Authentication Family

SOC 2 · 4 controls

SOC2-CC5.2 CC5.2 General controls over technology (COSO principle 11)
SOC2-CC6.1 CC6.1 Logical access security over protected information assets
SOC2-CC6.2 CC6.2 Registering and authorising users before issuing credentials
SOC2-CC6.6 CC6.6 Protection against threats from outside the system boundary

Australian Information Security Manual · 2 controls

ISM-1504 Multi-factor authentication for online services
ISM-1679 Multi-factor authentication for sensitive online services

C5 (Germany) · 2 controls

C5-IDM-09 Authentication mechanisms
C5-PSS-05 Authentication Mechanisms

CMMC 2.0 · 2 controls

IA.L2-3.5.2 Authentication
IA.L2-3.5.3 Multifactor Authentication

ISO 27701:2019 · 2 controls

6.6.2 User access management
6.6.4 System and application access control

NIST Cybersecurity Framework 2.0 · 2 controls

NIST-CSF-PR.AA-03 Users, services, and hardware are authenticated
NIST-CSF-PR.IR-01 Networks and environments are protected from unauthorized logical access and usage

NIST SP 800-171 Rev 3 · 2 controls

03.05.03 Multi-Factor Authentication
03.05.04 Replay-Resistant Authentication

ACSC Essential Eight · 1 control

E8-MFA-ML1 Multi-Factor Authentication - Maturity Level 1

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

ANSSI-HYG-13 Prefer Strong Authentication Where Possible

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

ASD37-20 Multi-factor authentication (Essential)

AWS Well-Architected Security Pillar · 1 control

SEC02-BP01 Use strong sign-in mechanisms

Australia Consumer Data Right - Banking (CDR) · 1 control

AUCDR-IS-1 Limit risk of unauthorised access to the CDR data environment

Azure Security Benchmark · 1 control

IM-6 Use strong authentication controls

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 1 control

CCM-IAM-14 Strong Authentication

HIPAA Security Rule · 1 control

164.312(d) Person or Entity Authentication (Standard)

NIST SP 800-161 Rev 1 · 1 control

161R1-IA-8 Identification and Authentication (Non-Organizational Users)

NIST SP 800-172 · 1 control

3.5.3e Prohibit Connection of Unknown or Unverified System Components

NIST SP 800-66 Rev 2 · 1 control

164.312(d) Person or Entity Authentication (Standard)

UK Cyber Essentials · 1 control

CE-SC.6 Multi-Factor Authentication for Cloud Services

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of CIS Controls v8 have you already done?

CIS Controls v8 CIS-6.3 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of CIS Controls v8 your existing evidence covers. Hold ISO 27001:2022 and 102 of 153 CIS Controls v8 controls already carry evidence.

If you hold ISO 27001:202266.7% covered · 51 gaps If you hold FedRAMP Moderate62.7% covered · 57 gaps If you hold NIST SP 800-53 Rev 557.5% covered · 65 gaps If you hold NIST Cybersecurity Framework 2.050.3% covered · 76 gaps If you hold ISO 27002:202249.7% covered · 77 gaps If you hold Azure Security Benchmark49% covered · 78 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 240 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 each Browse the graph free