# Does NIS2 require multi-factor authentication?

It lists it as a required area, where appropriate. Article 21(2)(j) includes the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate. Where appropriate leaves room for a risk-based decision, but for the accounts attackers target most, it is hard to justify not using it: e-mail, remote access and VPN, administrator accounts, cloud consoles, backup systems and finance applications. Start there, use authenticator apps or hardware keys rather than SMS where you can, cover service providers' accounts too, and keep a list of documented exceptions with the reason for each. Insurers usually ask about the same accounts. NetSenX itself offers two-factor authentication on every plan; it does not manage MFA for your other systems.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [NIS2 scope and duties](https://netsenx.com/en/faq/nis2) · https://netsenx.com/en/faq/does-nis2-require-multi-factor-authentication

## Read next

- https://netsenx.com/en/nis2-network-monitoring
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [Does NIS2 require encryption?](https://netsenx.com/en/faq/does-nis2-require-encryption)
- [Does NIS2 require backups and a business continuity plan?](https://netsenx.com/en/faq/does-nis2-require-backups-and-business-continuity)
- [What does NIS2 say about supply chain security?](https://netsenx.com/en/faq/what-does-nis2-say-about-supply-chain-security)
- [Does NIS2 require an inventory of IT assets?](https://netsenx.com/en/faq/does-nis2-require-an-asset-inventory)
- [Who supervises NIS2 compliance, and what can the supervisor do?](https://netsenx.com/en/faq/who-supervises-nis2-and-what-can-they-do)