Critical Infrastructure Risk Management Program (CIRMP) Rules 2023 8B: s 8B Credential compromise hazards: phishing-resistant multi-factor authentication where the chosen framework does not require it, with central logging

Where the enhanced-class entity's chosen framework does not itself require phishing-resistant multi-factor authentication, it must establish and maintain a process or system in its CIRMP to outline the systems and networks where phishing-resistant MFA is required to authenticate access to its internet-connected computers and critical systems, privileged and unprivileged access to critical components, and remote access to applications, systems or services, and so far as reasonably practicable to minimise or eliminate the material risk of a credential compromise hazard and mitigate its impact; implementing phishing-resistant MFA for those systems and networks and centrally logging, monitoring and routinely reviewing successful and unsuccessful MFA attempts is taken to be the action that minimises or eliminates the risk, and where the entity cannot implement it the CIRMP still holds the reasonable steps it takes; for the annual report it has regard to whether the CIRMP outlines those systems, describes the credential compromise hazards and contains appropriate measures.