Loading

Enabling 2FA

Two-factor authentication asks for something beyond the password: a code from an authenticator app, a text message or an e-mail. It is the single most effective control available against stolen passwords.

Where to find it

Architect Panel → Configuration:

  • Site Settings — whether 2FA is enabled and enforced, and the one-time code settings

Architect Panel → Security:

  • Two-Factor Authentication — registered authenticator tokens
  • Security Check-up — the Multi-factor authentication section: enforcement, methods offered and coverage
  • Passkeys — the stronger alternative

Each person sets up their own methods on My Account, in the 2-Factor Authentication (2FA) card.

What it protects against

A password that has been guessed, phished, reused from a breached site, or read off a note. In every one of those cases the attacker has the password and still cannot sign in. Given that password reuse is near-universal, this is the control that turns somebody else's breach into a non-event for you.

What it does not protect against

A convincing fake sign-in page can ask for the code as readily as the password, and a user who types one will type the other. Two-factor authentication raises the cost of phishing considerably; it does not eliminate it. Passkeys do, because the credential is bound to the real site. Where you can use passkeys, particularly for administrators, they are the better control.

The three methods

  • Authenticator app (TOTP): the strongest of the three, and the one to recommend. See Authenticator Apps.
  • SMS: a code by text to a verified mobile number. Weaker, because numbers can be hijacked.
  • E-mail: a code to the address on the account. The weakest, because the same mailbox usually receives password resets. See E-mail Codes.

Which methods are offered, and in which order, is set in the server configuration by your hosting administrator rather than on Site Settings. The shipped order is authenticator app, then SMS; e-mail is offered only when added. When somebody has more than one method set up, they are asked for the first one in that order, so keep the authenticator app first.

Enabling it

  1. In Site Settings, make sure 2FA is enabled. On its own this compels nobody: people can enrol, and those who do get the protection.
  2. Open Security Check-up and read the Multi-factor authentication section. Methods offered shows what people can choose from.
  3. Ask administrators to enrol first on My Account, then everybody else.
  4. Watch the "accounts with an authenticator app" figure in the Security Check-up rise, and use its View accounts button to see who is left.
  5. Only then consider requiring it: see Forcing 2FA.

How an assessor will read it

The Security Check-up marks 2FA that is available but not enforced as Action needed, because Cyber Essentials expects multi-factor authentication on administrative accounts. It marks enforcement for some groups only as Review, and e-mail codes offered as the only method as Action needed. Its coverage figure counts authenticator apps only.

Have a recovery path before you need one

People lose phones. Decide who can reset a second factor, how they verify the person asking, and what gets recorded, before anybody is locked out rather than during. Make that verification at least as rigorous as the factor it bypasses: an attacker who cannot phish a code will telephone your service desk instead.

Turning off SMS or e-mail codes on My Account, or deleting an authenticator token, asks the person to prove who they are again first, so somebody who finds an unlocked, signed-in browser cannot quietly remove a factor.

Worked example

An organisation enables 2FA and asks its twelve administrators to set up an authenticator app within a fortnight; all do. It is then opened to all staff with a short explanation. The Security Check-up shows coverage reaching about 70% in a month, and View accounts lists the rest for their managers. Only then does the organisation consider requiring it, with a clear picture of who is left and why.

Recommendations

  • Enable it before forcing it.
  • Administrators first, with an authenticator app or a passkey.
  • Keep authenticator apps first in the method order.
  • Track coverage in the Security Check-up.
  • Design and test recovery first.