Multi-factor authentication for cloud services: what the requirement means for a small business

If your business uses Microsoft 365, Google Workspace, an online accounting package or any other account-based online service, one Cyber Essentials requirement deserves your attention first. Authentication to cloud services must always use multi-factor authentication. This article explains what that means and how a small business can meet it.

What the requirement says

In its user access control section, the Cyber Essentials requirements ask organisations to implement multi-factor authentication (MFA) where it is available, and then add a firm line: authentication to cloud services must always use MFA.

The document defines MFA as a method of authenticating a user that uses two or more verification factors. In everyday terms, a password alone is not enough. A second check, such as a prompt on your phone or a physical key, has to succeed before you get in.

Which cloud services count

The requirements define a cloud service as an on-demand, scalable service on shared infrastructure, accessed over the internet through an account, which stores or processes your organisation’s data. The account may use credentials your organisation issued, or an email address used for business purposes. The document gives Microsoft 365, Dropbox and Gmail as examples of software as a service.

Two points matter for small businesses. First, cloud services cannot be excluded from scope, so you cannot avoid the requirement by leaving the service out. Second, user access control stays with your organisation for every type of cloud service. The provider may look after other controls, but who can sign in, and how, is your job.

Which factors are acceptable

The document lists four types of additional factor to consider:

• a managed or enterprise device
• an app on a trusted device
• a physically separate token
• a known or trusted account

It says additional factors should be usable and accessible, and suggests you might need to test with your users to decide what suits them. The password part of an MFA approach must be at least eight characters long, with no maximum length.

The requirements are candid about text messages: SMS is not the most secure type of MFA, but it still offers a huge advantage over no MFA at all. If an alternative will work in your situation, the document recommends using it instead of SMS.

The NCSC’s separate guidance on MFA for corporate online services is written for administrators and describes the various types of MFA, explains some pitfalls and helps you apply the strongest methods.

Passkeys and passwordless sign-in

Version 3.3 widened the definition of passwordless authentication to include FIDO2. The document counts FIDO2 authenticators as passkeys, and regards them as MFA because user authentication is performed. Other examples it lists include biometrics, security keys or tokens, push notifications and one-time codes. If your services support passkeys, that can be a smooth way to meet the requirement.

Administrator and internet-facing accounts

The document says you should always use MFA to give administrative accounts extra security, along with accounts that are accessible from the internet. Administrative accounts have wide powers, so a stolen password there causes more damage than one stolen from an ordinary user.

What about the phone that holds the app?

If your staff use a personal phone only for MFA apps, calls and texts, the document says that phone is out of scope. That is helpful for small teams: approving sign-ins on a personal phone does not pull that phone into your assessment.

How it is checked

In the standard assessment, you answer questions and an assessor marks them. Cyber Essentials Plus goes further. According to the Plus test specification, the assessor tests all cloud services. The assessor observes users signing in with organisation accounts from an untrusted device or an incognito browser session. If the user or administrator is prompted for a form of MFA before access is granted, that test is a pass. If not, it is a fail.

A simple plan for a small business

1. List your cloud services. Include the obvious ones such as email and file storage, and the less obvious ones such as accounting, payroll and customer systems.
2. Check each service’s sign-in settings. Most business services have an MFA option in their security settings.
3. Turn on MFA for every user, including administrators. Do not leave out the owner or the part-time bookkeeper.
4. Choose factors people will actually use. An approval app or a passkey is often easier than a code that has to be typed.
5. Record what you did. Notes on which services use MFA and how will make your answers quicker and more accurate.

If a service you rely on cannot support MFA, the requirement is still firm for cloud services, so you will want to weigh up whether that service is right for you. The NCSC’s resources explain where to find help, including its network of Cyber Advisors.

In short

Authentication to cloud services must always use MFA to meet Cyber Essentials. SMS counts as MFA but stronger options are recommended, passkeys are recognised, and a phone used only for MFA apps stays out of scope. Switch it on for every user and every service, administrators first.

How Vigil CE helps

Vigil CE gives you a list of your cloud services with a clear MFA check against each one, so nothing is left to memory. You can see at a glance which accounts are protected and which still need a second factor, and keep the notes for your assessment alongside them.