The NIS2 Directive directly promotes the use of multi-factor authentication (MFA) as a cybersecurity measure.

• Article 21, Paragraph 2(j): Explicitly indicates “the use of multi-factor authentication or continuous authentication solutions” as one of the key security elements that essential and important entities must consider when implementing cyber risk management measures.

Although the Directive does not make the adoption of MFA mandatory in all cases, its inclusion among these elements highlights the importance of such a security control, particularly for:

• Access Control: MFA adds an extra layer of security for accessing sensitive systems and data, making it significantly more difficult for unauthorized users to gain access, even if they have compromised an authentication factor (e.g., a password).
• Reducing the Impact of Compromised Credentials: Given the prevalence of phishing attacks and breaches leading to password theft, MFA acts as a critical safeguard by requiring additional verification factors, which are typically harder for attackers to obtain.

The general requirements of the NIS2 Directive also implicitly support the use of MFA through:

• Risk Management Approach: The Directive’s emphasis on a risk-based approach to cybersecurity (Article 21) implies that entities must assess risks to their systems and data and implement appropriate controls. Given the effectiveness of MFA in mitigating the risks of unauthorized access, it would likely be considered a proportionate and essential measure for many organizations subject to the Directive.
• Security of Network and Information Systems: Article 21, Paragraph 1, requires entities to take measures to manage risks and “prevent or minimize the impact of incidents.” MFA aligns directly with this objective by strengthening access security and reducing the likelihood of successful breaches.

In summary: While the NIS2 Directive does not explicitly mandate the use of multi-factor authentication in every scenario, it strongly encourages its adoption through:

• Its direct inclusion as a key security element to consider.
• The risk-management-based regulatory framework, where MFA represents a highly relevant control.
• The emphasis on the need to protect systems and minimize the impact of incidents.

For organizations that need to structure or verify their compliance journey, the ISGroup NIS2 Compliance service supports the identification of required technical measures, including the assessment of authentication controls provided for in Article 21. The full text of the regulation can be consulted in the official NIS2 Directive document.