MHC-03 Phishing-resistant multi-factor authentication

At a glance

Operational benefit

renders intercepted or captured credentials worthless on spoofed pages and thereby removes the basis for AI-supported, deceptively convincing phishing.

Policy affected

access control and authentication policy.

Dependencies

no precondition; works well together with MHC-04 (privileged access).

Effort drivers

depends on the number of users, services and legacy systems and on the existing identity platform. The actual effort depends on the organization's resources.

Primary metric

phishing-resistant account coverage — the number of in-scope accounts secured with phishing-resistant methods divided by the number of all in-scope accounts. Target for privileged accounts: 100% or a documented, time-limited and risk-approved exception. The share of logins using phishing-resistant methods is collected only as a supplementary usage metric, because individual heavily used accounts would otherwise distort the picture.

Standards touched (no claim of fulfilment)

ISO/IEC 27002 A.5.17/A.8.5; NIST SP 800-63B Revision 4; FIDO2/WebAuthn; C5:2026 IAM-08; NIS2 IR No. 11.6 and No. 11.7, for privileged accounts additionally No. 11.3.2(a).

Control statement

Privileged access and externally reachable services are secured with phishing-resistant methods (FIDO2/WebAuthn, passkeys or hardware tokens). Terminological clarification: a device-bound passkey satisfies the multi-factor criterion only together with local user verification (PIN or biometrics); without it, only a possession factor is present. What matters for protection against AI-supported phishing is origin binding, not the number of factors. SMS and simple confirmation methods are excluded for new access. Advanced hardening (Managed level): extension to access to internal systems classified as particularly worthy of protection, up to organization-wide passwordless sign-in.

Purpose and threat relevance

AI has sharply increased both the quality and the volume of phishing: spoofed sign-in pages, deceptively convincing emails and codes relayed in real time bypass classic two-factor methods such as SMS or app confirmation. Phishing-resistant methods bind the sign-in proof cryptographically to the genuine address of the service; on a spoofed page the proof is therefore worthless. The protective objective is that intercepted or captured credentials are of no use to the attacker.

Effect across frameworks

These are the controls and requirements the MHC acts on. The classification shows how much each control loses its effect under AI-enabled attacks.

All 93 controls in the analysis matrix · All 45 controls in the findings matrix · All 23 requirements of the module family

Maturity path

Initial

FIDO2/passkeys for privileged access.

Defined

phishing-resistant methods mandatory for all privileged access and all externally reachable services; password-only authentication without an additional factor excluded organization-wide.

Managed

passwordless sign-in organization-wide; SMS methods switched off.

Measurement and audit evidence

Metric

phishing-resistant account coverage — share of in-scope accounts with phishing-resistant protection, reported separately for privileged and externally reachable accounts (target: privileged 100% or a documented, time-limited and risk-approved exception; externally reachable 95% or above). The share of logins using phishing-resistant methods is collected only as a supplementary usage metric.

Evidence

identity platform configuration, list of permitted methods per access class, evidence of the decommissioning of SMS methods.

Evidence logic (following ISO/IEC 27001, Clause 9)

documented? — authentication policy and platform configuration; responsible? — identity and IT lead; frequency? — continuous; tolerance? — no privileged or externally reachable access with SMS or simple push confirmation only.

Typical mistakes

• Phishing-resistant methods are introduced, but weaker methods remain active as a fallback — the attacker uses the weakest path.
• Synchronizable passkeys are deployed for the highest assurance level, even though a device-bound, non-exportable key is required there.
• The fallback procedure on loss (for example a reset by telephone) undercuts the protection level.
• Only individual applications are migrated, while privileged access remains protected more weakly.

Delimitation and residual risk

Delimitation

concerns the sign-in proof of users; the identity of services and workloads is covered by MHC-04.

Residual risk

attacks may shift to the recovery and fallback procedures; session takeover after successful sign-in also remains a topic of its own. A compromised endpoint can moreover — even with a device-bound passkey — produce valid authentication proofs (abuse of the local authenticator interface after sign-in); that path is addressed not by MHC-03 but by endpoint hardening (A.8.7) and behaviour-based detection (MHC-05).

Effectiveness limit

phishing-resistant does not mean phishing-proof. FIDO2/passkeys devalue classic credential phishing and MFA fatigue, but not session or token theft by malware, adversary-in-the-middle after sign-in, or social engineering at the help desk.

ISO/IEC 27002:2022

A.5.17 Authentication information; A.8.5 Secure authentication; A.6.7 Remote working; A.8.1 User endpoint devices; A.8.23 Web filtering.

Framework

NIST SP 800-63B Revision 4 (assurance levels AAL2/AAL3); FIDO2/WebAuthn (FIDO Alliance, W3C); C5:2026 IAM-08; NIS2 IR No. 11.6 (authentication) and No. 11.7 (multi-factor authentication), for privileged accounts additionally No. 11.3.2(a).

Implementation in detail

Organizational and technical implementation, implementation examples and the prioritization within the overall programme are described in the Implementation Guide.

Implementation Guide (PDF)Back to the MHC catalog

Source: MRIS Implementation Guide (ISO/IEC 27001), edition 2.0. License CC BY-SA 4.0. © 2026 Richard Peddi.