Sekit CSF · Identity & Access Management · Policy
RCF-0064Strong authentication (MFA)
A second verification step beyond password is required to access critical systems
Mapping at a glance
RCF-0064Strong authentication (MFA)Identity & Access Management · Policy
RCF-0064 maps to 7 controls across the published frameworks. +2 more in the table below. Open in the full graph →
Maps to ISO/IEC 27001:2022 · Annex A controls
Curated mapping with the reasoning, not just the codes.
A.5.15Access controlsupportsRequiring a second factor on email, the identity platform and systems holding important data is a specific access control rule A.5.15 asks organisations to enforce based on business need.A.5.17Authentication informationsupportsRequiring a second authentication factor is a control on how authentication itself is verified, one of the concrete safeguards A.5.17 asks organisations to put around credentials.A.8.5Secure authenticationsupportsThis policy facet requires a second authentication factor for email, the identity platform, remote access and every system holding important data, the written commitment A.8.5 asks for.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
Maps to Cyber Essentials
Curated mapping with the reasoning, not just the codes.
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
MFA enrollment evidence
The proof that a second verification step (beyond the password) is required to access important systems.
From the Sekit evidence catalog
This topic through the other lenses
All Identity & Access Management controls
Ask Sekura: “What evidence proves RCF-0064?”
Connect your AI · free MCP
https://sekit.ai/api/mcp/crosswalk- In Claude or ChatGPT, add a custom connector and paste this URL.
- Sign in with your email to finish. Free, read-only, no organization required.