This is general educational guidance, not an assessment of your business or a guarantee of security. Check the original sources and your specific requirements before acting.
What MFA actually means
MFA combines at least two different authentication factors, such as a password and an authenticator app or security key. An extra password alone is not necessarily a separate factor.
What a passkey changes
A passkey uses cryptography tied to the website or app. A properly implemented passkey makes it harder to sign in to an imitation website, and may replace traditional passwords on supported services.
- Use a passkey where an important provider supports it.
- For other accounts, prefer strong MFA such as a security key or authenticator-based method over relying on password-only access.
- Review backup and account recovery arrangements before changing your primary sign-in method.
Do not weaken recovery
A business may be locked out if its only MFA device is lost. Recovery must be planned, but it also needs protection.
- Keep recovery codes securely and restrict who can use them.
- Remove access when staff or contractors depart.
- Treat unexpected MFA prompts as suspicious and investigate them.
Read the original guidance
The links below are from the original publishers. This article is independently written by TASII and does not imply endorsement.
- Securing accounts and identitiesASD’s Australian Cyber Security Centre · 7 October 2026
- Implement fundamental cyber security controlsASD’s Australian Cyber Security Centre · 7 October 2026
