Multi-factor authentication for Cyber Essentials v3.3: the complete pillar guide

MFA protects accounts when a password is stolen. A useful implementation covers the actual cloud services, administrators, contractors and remote-access paths in your organisation, rather than just the accounts visible in your main directory.

This pillar explains the scheme baseline and how to roll it out across Microsoft 365, Google Workspace and other SaaS. See Cyber Essentials pricing or start certification.

The NCSC requirements v3.3, pages 19-22, require MFA wherever it is available, and authentication to cloud services must always use MFA. This is not a new requirement for a fresh challenge at every sign-in or a blanket requirement on every local account regardless of capability.

MFA combines independent factors. Password plus authenticator app, hardware token or SMS is a familiar pattern. Where a password is used as part of MFA, it needs at least eight characters with no maximum-length restriction.

FIDO2 passkeys with user verification can provide passwordless MFA. A biometric, one-time code or product name alone does not establish that two factors were used: verify the actual sign-in flow.

Security Defaults and Conditional Access provide different policy options. Choose by your licensing and control needs, then test whether the implementation covers the in-scope authentication paths.

1. Review Microsoft's current Security Defaults instructions. The former fourteen-day registration grace was removed on 29 July 2024.

2. Register supported methods and verify enforcement. Registration alone does not show that a policy requires MFA.

3. Block basic or legacy authentication that bypasses the policy. POP, IMAP and SMTP are protocols that can also use OAuth; they are not synonyms for basic authentication.

4. Microsoft Authenticator push has number matching enabled; there is no old enable/disable toggle to configure.

5. Plan supported emergency access and test recovery before enforcing policies that could lock out administrators.

See MFA for Microsoft 365 step-by-step.

Use Google Admin's Security → Authentication → 2-Step Verification settings. Allow enrolment, prepare users and recovery, then enforce 2SV for the relevant organisational units or groups. A planned enrolment window is not a certification grace period: required controls must be effective at assessment.

Google removed less-secure-app password-only access on 1 May 2025. Use current OAuth-capable clients rather than instructions for the retired toggle.

Advanced Protection supports passkeys or security keys. It is useful additional hardening, not a universal Cyber Essentials administrator requirement. See the Google Workspace guide.

Inventory every service storing or processing organisational data, including tools bought outside central IT. Enforce MFA directly or through a controlled SSO path. Check that direct sign-in, recovery and guest access cannot bypass the intended protection.

An existing MFA-authenticated session can satisfy a service's policy without a new prompt every time. Review token and session behaviour as well as visible prompts; Cyber Essentials sets no universal twelve-hour session timer.

Use individual credentials and separate accounts for administrative work and ordinary email or browsing. Implement MFA where available and always for cloud-service authentication.

We recommend phishing-resistant credentials, monitored emergency access and documented recovery for privileged users. These are hardening and resilience choices; the scheme does not prescribe sealed envelopes, two emergency accounts or a universal logging period.

Your organisation must control the third party's access and understand the authentication used. A controlled federated identity can be suitable if MFA is enforced and verified; contractors do not universally need a new account provisioned inside your own identity provider.

See Cyber Essentials BYOD rules for device scope.

Distinguish unattended machine authentication from human sign-in. For non-cloud products, document MFA availability and apply the requirement where available. A cloud service without an effective MFA route cannot be waived merely by documenting inconvenience or a legacy limitation; discuss a compliant alternative with the certification body.

For self-assessment, describe the services, human accounts, methods and enforcement policies accurately. Useful evidence includes policy configuration, representative sign-in results and explanations of technical identities and recovery paths. A screenshot showing registration is insufficient on its own.

For Plus, follow the applicable technical test specification and agreed scope; see the remote audit guide.

Record the actual MFA implementation for each cloud service and MFA availability elsewhere. Keep stronger-factor and session recommendations distinct from the scheme minimum, and check recovery before rollout.

Get the fastest Cyber Essentials certification in 6 working hours for complete compliant submissions received before midday on a UK business day | Buy CE Micro £299.99 | See pricing