SekitCrosswalk
ENES
Start now
Cyber Essentials · derived mapping target

CE4.3Require multi-factor authentication

Enable multi-factor authentication wherever it is available, and require it without exception for all access to cloud services and for every administrative account.

Mapping at a glance
CE4.3Require multi-factor authenticationCyber Essentials
RCF-0064Strong authentication (MFA)Identity & Access Management · PolicyRCF-0065Strong authentication (MFA)Identity & Access Management · ProcessRCF-0066Strong authentication (MFA)Identity & Access Management · TechnicalRCF-0072Privileged access managementIdentity & Access Management · TechnicalRCF-0075SSO & federationIdentity & Access Management · Technical

CE4.3 is covered by 15 Sekit CSF controls. +10 more in the table below. Open in the full graph →

Mapped from the Sekit CSF

The Sekit controls that cover this requirement, lens by lens.

RCF-0064Strong authentication (MFA) · PolicyRCF-0065Strong authentication (MFA) · ProcessRCF-0066Strong authentication (MFA) · TechnicalRCF-0072Privileged access management · TechnicalRCF-0075SSO & federation · TechnicalRCF-0082Remote access · PolicyRCF-0083Remote access · ProcessRCF-0084Remote access · TechnicalRCF-0186Zero Trust network access · TechnicalRCF-0189VPN management · TechnicalRCF-0291Alternate work sites · TechnicalRCF-0334Cloud IAM · PolicyRCF-0336Cloud IAM · TechnicalRCF-0352SaaS security configuration · PolicyRCF-0353SaaS security configuration · Process

ISO/IEC 27001:2022 counterparts

Reached through the Sekit CSF controls both map to — a mapping, not a formal equivalence.

A.8.5 Secure authenticationA.6.7 Remote workingA.5.15 Access controlA.8.9 Configuration managementA.8.24 Use of cryptographyA.8.20 Networks securityA.5.16 Identity managementA.5.17 Authentication informationA.8.2 Privileged access rightsA.5.23 Information security for use of cloud servicesA.8.16 Monitoring activitiesA.8.15 LoggingA.5.30 ICT readiness for business continuityA.5.22 Monitoring, review and change management of supplier servicesA.6.3 Information security awareness, education and trainingA.8.18 Use of privileged utility programs

NIST CSF 2.0 counterparts

PR.AA-05 Access permissions managedPR.AA-01 Identities and credentials managedPR.IR-01 Networks protected from unauthorized accessPR.AA-03 Users and devices authenticatedPR.AA-02 Identities proofed and boundPR.PS-01 Configuration management appliedPR.PS-02 Software maintainedPR.IR-04 Adequate capacity maintainedRC.RP-01 Recovery plan executed

Evidence that proves this control

What an auditor, or Sekit's evidence engine, asks for.

MFA enrollment evidence
The proof that a second verification step (beyond the password) is required to access important systems.
From the Sekit evidence catalog

Related controls

Via the shared Sekit CSF topic, not the framework's own index.

CE1.2 Protect the administrative interfaceCE1.3 Block unauthenticated inbound trafficCE2.1 Remove unnecessary accounts and softwareCE2.2 Change default and guessable passwordsCE4.1 Manage the account lifecycleCE4.2 Control administrative privilegesCE4.4 Protect passwords against guessing
Ask Sekura: “What evidence proves CE4.3?”
Also via MCP, free with account