MFA (Multi-Factor Authentication)
Mandatory protection for all privileged access
TL;DR
MFA is authentication using at least 2 of 3 factors (knowledge, possession, inherence). § 30(2) no. 10 of the German BSI Act (BSIG) requires MFA for privileged access — and realistically for all access.
What is MFA (Multi-Factor Authentication)?
MFA methods in 2026:
- Phishing-resistant: FIDO2/WebAuthn (hardware keys, passkeys) — the gold standard
- Strong: authenticator app (TOTP, push)
- Weak (avoid): SMS OTP — susceptible to phishing
For high assurance levels, NIST SP 800-63B requires FIDO2 ONLY.
Legal basis in Germany and Austria
MFA is a statutory NIS2 risk-management measure in both jurisdictions. The requirement is identical in wording; only the citation and the supervisory authority differ:
- Germany: § 30(2) no. 10 BSIG requires the "use of multi-factor authentication or continuous authentication solutions". Supervision: Federal Office for Information Security (BSI). (§ 30(2) no. 8 BSIG, by contrast, concerns cryptographic procedures, not MFA.)
- Austria: § 32(4)(j) of the Austrian Network and Information Systems Security Act 2026 (NISG 2026) (BGBl. I Nr. 94/2025) contains the same requirement. Supervision: Cybersecurity Authority (Cybersicherheitsbehörde, Austria).
Practical example
SME with 80 employees: 100% MFA via Microsoft Authenticator. Privileged accounts additionally use a YubiKey FIDO2. Sessions outside MFA are blocked by Conditional Access.
Frequently asked questions
Is SMS MFA OK?
Weak. NIST and the BSI advise against it — susceptible to phishing and SIM swapping. Use an authenticator app or FIDO2.
What does it cost?
Authenticator apps are free. FIDO2 keys cost EUR 25-60 each. Conditional Access: included in Microsoft 365 E5.
See also
Practitioner note: This article is practice-oriented compliance documentation, not legal advice. We are compliance specialists, not a law firm. For legally binding advice, consult an admitted lawyer.