Netherlands Baseline Information Security for Government 2 (BIO2) 5.17.01: Multi-factor authentication, mitigations where it is impossible, and authentication data management

What does 5.17.01 require?

The entity applies multi-factor authentication at least for primary logins to the digital work environment, for accounts that open internet-facing services, for accounts carrying administrative privileges and wherever the risk analysis points to it, in two forms: passwordless access, say a PIN together with a hardware token, or else a personal and unique certificate (a passkey), or access by password plus at least one further factor. Where MFA is impossible for such accounts, other mitigating measures are taken with the CISO involved and the process owner's approval. Where possible and safe, MFA is paired with federated authentication, for instance single sign-on plus a stepping-stone solution. Authentication information is issued through formally established procedures after the user's identity is established with sufficient certainty, and use cases for abuse of authentication data are defined, monitored and acted on, covering at minimum logins attempted from unusual locations and surges in failed logins.