November 2026. Control 8.5 (secure authentication) in Annex A prescribes no specific technique, but in practice an auditor expects multi-factor authentication (MFA) on everything that matters. It often goes wrong with the exceptions. See also our article on access control.
Where MFA belongs at minimum
Administrator accounts, remote access (VPN, remote desktop), email and collaboration platforms, cloud and SaaS services holding company data, and supplier accounts with access to your environment. Start with administrators: they are the accounts with the greatest impact.
Choose the strength of the factor
Not all MFA is equally strong. SMS codes are weaker than app codes, and phishing-resistant methods such as passkeys or security keys are strongest. See passkeys for the trade-offs.
Exceptions: record them
Some systems cannot support MFA technically, such as legacy applications or service integrations. Document each exception with a reason, owner, compensating measures (such as IP restriction, strong passwords and monitoring) and an end date or review moment. An exception without a record is a finding.
Service integrations and shared accounts
Shared accounts are the classic weak spot. Replace them with personal accounts where possible; for technical accounts use secrets in a vault, limited permissions and logging. Also read about the password policy.
Evidence for the auditor
A report from your identity platform with the percentage of accounts with MFA, the policy, the exception list and an example of a completed review. That shows it is more than an intention.