NIST CSF 2.0, ProtectPR.AA-03

Ensure, where appropriate and in accordance with the classification of the asset to be accessed, that users are authenticated by multiple authentication factors or continuous authentication mechanisms (point 11.7.1).

When you apply strong customer authentication, base it on two or more elements categorized as knowledge, possession and inherence and generate an authentication code that you accept only once, from which no information on the elements can be derived, that cannot be generated from another code and that cannot be forged. Do not reveal which element was incorrect when authentication fails, do not allow more than five consecutive failed attempts within a given period of time before the action is blocked, protect communication sessions against the capture of authentication data, and do not allow more than 5 minutes without activity by the payer after authentication for online access to a payment account (Article 4).

For an electronic remote payment transaction, make the payer aware of the amount and the payee, generate an authentication code that is specific to the amount and the payee the payer agreed to, accept only a code that corresponds to that amount and payee, invalidate the code if the amount or the payee changes, and protect the confidentiality, authenticity and integrity of the amount, the payee and the information displayed throughout all phases of the authentication (Article 5).

Adopt at least two-factor authentication for any user accessing the system from outside the bank or financial institution, fully encrypt highly sensitive data, filter inbound email, verify the security of devices employees use outside the institution, run penetration testing, monitor network traffic, and verify data integrity.

The Department says you should consider authentication factors that can withstand AI-manipulated deepfakes, avoiding authentication by SMS text, voice or video and using forms such as digital-based certificates and physical security keys; it states that as of November 2025 the regulation requires multi-factor authentication for all authorized users attempting to access your information systems or nonpublic information, and that your access controls must limit each authorized user's privileges to those necessary for the user's job functions.

The Department says you should consider restricting multi-factor authentication enrollment and changes to authorized processes with strong identity verification, employing phishing-resistant multi-factor authentication methods such as authenticator applications with number matching or hardware tokens, and conducting privileged access reviews, especially for threat-relevant users, systems and devices.

Use multi-factor authentication, verification of at least two of three types of authentication factor (knowledge, possession and inherence), for any individual accessing any of your information systems.

If you qualify for the limited exemption in section 500.19(a), use multi-factor authentication for remote access to your information systems, remote access to third-party applications (including cloud-based ones) from which nonpublic information is accessible, and all privileged accounts other than service accounts that prohibit interactive login.

Take technical, operational, organisational and physical protection measures across the areas Article 10 lists, including multi-factor authentication or a continuous-authentication solution, secured voice, video and text communication, and secured communication channels for emergencies.

Print any factory-set password on a label on the device and restore it whenever the device is reset to factory settings; require any user-set password to be at least 8 characters with an uppercase letter, a lowercase letter, a number, and a special character, and check new passwords against a password dictionary or an equivalent method to block weak or commonly used ones.

Provide reliable mechanisms for the identification and authentication of health professionals in an EHR system designed to be used by health professionals (Annex II, point 3.1).

Where you operate an Electronic Agent, an automated device that carries out an action on Electronic Information for a user without that user's direct intervention, such as an automated transaction or e-commerce system, additionally run a standard operating procedure meeting six security-control principles for user data and Electronic Transactions: confidentiality, integrity, availability, authenticity, authorization, and non-repudiation, and test a transacting user's identity and authorization before completing the transaction.