Does NIS2 require multi-factor authentication?
It lists it as a required area, where appropriate. Article 21(2)(j) includes the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate. Where appropriate leaves room for a risk-based decision, but for the accounts attackers target most, it is hard to justify not using it: e-mail, remote access and VPN, administrator accounts, cloud consoles, backup systems and finance applications. Start there, use authenticator apps or hardware keys rather than SMS where you can, cover service providers' accounts too, and keep a list of documented exceptions with the reason for each. Insurers usually ask about the same accounts. NetSenX itself offers two-factor authentication on every plan; it does not manage MFA for your other systems.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.