NIST Privacy Framework, Protect-PPR.AC-P6

Ensure, where appropriate and in accordance with the classification of the asset to be accessed, that users are authenticated by multiple authentication factors or continuous authentication mechanisms (point 11.7.1).

When you apply strong customer authentication, base it on two or more elements categorized as knowledge, possession and inherence and generate an authentication code that you accept only once, from which no information on the elements can be derived, that cannot be generated from another code and that cannot be forged. Do not reveal which element was incorrect when authentication fails, do not allow more than five consecutive failed attempts within a given period of time before the action is blocked, protect communication sessions against the capture of authentication data, and do not allow more than 5 minutes without activity by the payer after authentication for online access to a payment account (Article 4).

For an electronic remote payment transaction, make the payer aware of the amount and the payee, generate an authentication code that is specific to the amount and the payee the payer agreed to, accept only a code that corresponds to that amount and payee, invalidate the code if the amount or the payee changes, and protect the confidentiality, authenticity and integrity of the amount, the payee and the information displayed throughout all phases of the authentication (Article 5).

The Department says you should consider authentication factors that can withstand AI-manipulated deepfakes, avoiding authentication by SMS text, voice or video and using forms such as digital-based certificates and physical security keys; it states that as of November 2025 the regulation requires multi-factor authentication for all authorized users attempting to access your information systems or nonpublic information, and that your access controls must limit each authorized user's privileges to those necessary for the user's job functions.

The Department says you should consider restricting multi-factor authentication enrollment and changes to authorized processes with strong identity verification, employing phishing-resistant multi-factor authentication methods such as authenticator applications with number matching or hardware tokens, and conducting privileged access reviews, especially for threat-relevant users, systems and devices.

Use multi-factor authentication, verification of at least two of three types of authentication factor (knowledge, possession and inherence), for any individual accessing any of your information systems.

If you qualify for the limited exemption in section 500.19(a), use multi-factor authentication for remote access to your information systems, remote access to third-party applications (including cloud-based ones) from which nonpublic information is accessible, and all privileged accounts other than service accounts that prohibit interactive login.

Do not let the Bulgarian national identification number (ЕГН) be the only means of identifying a user of a remote electronic service, and do not allow free public access to information containing it unless a law provides otherwise.

If you use a health information system, identify and authenticate with an identification digital certificate or another credential of substantial assurance level, and do not let anyone else use it (Article 10, paragraphs 1 and 2).

If you provide a very large online platform and require users to authenticate to access your service, also accept and facilitate the use of European Digital Identity Wallets for that authentication, only at the user's voluntary request and for the minimum data the service needs.

If you are a private service, other than a microenterprise or small enterprise, that law or contract requires to use strong user authentication for online identification, also accept European Digital Identity Wallets, only at the user's voluntary request, no later than 36 months after the Commission's implementing acts entered into force, which is by 24 December 2027.

As a Sociedad de Información Crediticia, use biometric identification techniques, such as comparing a consumer's photograph, to verify identity and make identity theft difficult when supplying a credit report, and protect the algorithms and technologies you use for that service under the strictest security and confidentiality.

Provide reliable mechanisms for the identification and authentication of health professionals in an EHR system designed to be used by health professionals (Annex II, point 3.1).

Where you operate an Electronic Agent, an automated device that carries out an action on Electronic Information for a user without that user's direct intervention, such as an automated transaction or e-commerce system, additionally run a standard operating procedure meeting six security-control principles for user data and Electronic Transactions: confidentiality, integrity, availability, authenticity, authorization, and non-repudiation, and test a transacting user's identity and authorization before completing the transaction.