Require MFA for Externally>Exposed Applications
Description
Require all externally-exposed enterprise or third-party applications to enforce MFA, where supported. Enforcing MFA through a directory service or SSO provider is a satisfactory implementation of this Safeguard.
Implementation Checklist
Tool Recommendations
Cloud identity and access management with SSO, MFA, conditional access, and identity governance
Microsoft · Per-user subscription (P1/P2)
Cloud identity platform providing SSO, adaptive MFA, lifecycle management, and API access management
Okta · Per-user subscription
Multi-factor authentication and zero-trust access platform with device trust and adaptive access policies
Cisco · Per-user subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Credential Stuffing Against External Applications
ConfidentialityAttackers use leaked credential databases to perform automated login attempts against externally-exposed applications that rely solely on passwords without MFA.
Phished Credentials Used to Access External Portals
ConfidentialityAn employee's credentials stolen through a phishing campaign provide immediate access to externally-exposed applications because no second factor is required for authentication.
Brute-Force Attack on Internet-Facing Login Portal
AvailabilityAttackers perform sustained brute-force attacks against internet-facing login pages where single-factor authentication allows unlimited credential guessing at scale.
Vulnerabilities (When Safeguard Absent)
Single-Factor Authentication on External Applications
Externally-exposed applications protected only by passwords are vulnerable to credential theft, stuffing, spraying, and brute-force attacks from anywhere on the internet.
No MFA Enforcement for Third-Party SaaS Applications
Third-party applications used by the enterprise lack MFA requirements, meaning a compromised password grants full access to potentially sensitive cloud-hosted data.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Technical | MFA enrollment status and enforcement configuration | Reviewed monthly |
| Record | Third-party risk assessment reports and scorecards | Annually per vendor |
| Document | Vendor contracts with security requirements | Per contract cycle |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |