GLOSSARY

An authentication process requiring a user to present evidence from at least two distinct authentication-factor categories before access is granted.

MFA reduces account takeover from stolen or reused passwords and is a foundational control for remote access, administration, and sensitive applications.

Administrators authenticate with a password and a phishing-resistant hardware key, while recovery requires separately controlled identity verification and is fully logged.

MFA is not immune to phishing, session theft, insecure recovery, push fatigue, or compromised endpoints. SMS and one-time codes generally provide weaker protection than phishing-resistant authenticators.

Factors commonly include something known, possessed, or inherent to the claimant. Strong MFA combines independent factors and resists phishing through cryptographic authenticators such as passkeys or security keys. Two steps using the same factor category do not necessarily constitute MFA.