# Multi-factor Authentication

- Source: https://support.icompaas.com/support/solutions/articles/62000225162-multi-factor-authentication
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CyberSecurity Taxonomy](https://support.icompaas.com/support/solutions/62000112345) › [CyberSecurity-Topics](https://support.icompaas.com/support/solutions/folders/62000168169)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Password Management Policy - Identity Management** 

  

MFA is an abbreviation for Multi-Factor Authentication. MFA is a security measure that requires users to provide more than one form of authentication when logging in to an online account. This can include a password, a security code, or a biometric factor such as a fingerprint or iris scan.  MFA is used to protect online accounts from unauthorized access, and to make it more difficult for hackers to gain access to sensitive information. MFA can also help to prevent phishing attacks, where criminals attempt to trick users into giving them their login credentials.  One of the most common forms of MFA is two-factor authentication (2FA), which requires users to provide both a password and a security code when logging in. 2FA is often used in conjunction with a password manager, which can help to keep track of multiple login credentials.  Another form of MFA is biometric authentication, which uses a physical characteristic of the user such as their fingerprint or iris scan. Biometric authentication is typically more secure than password-based authentication, as it is more difficult to fake a biometric factor.  MFA can also be used in conjunction with other security measures such as a Virtual Private Network (VPN) or a security token

  

The role of MFA in identity management is to provide an extra layer of security by requiring users to authenticate with something they know (such as a password) and something they have (such as a physical token or a mobile device with a one-time passcode). This makes it more difficult for attackers to gain access to accounts, even if they have stolen a user's password.

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.