Glossary term
MFA
Also: Multi-Factor Authentication
Authentication combining at least two factors from knowledge (password), possession (hardware token, smartphone) and inherence (biometrics). Mandatory under NIS2 Art. 21 (j) and DORA Art. 9.
Weak MFA: SMS or email OTP, vulnerable to SIM swapping and phishing. Medium MFA: TOTP apps like Google Authenticator, better than SMS but phishable.
Strong MFA: phishing-resistant factors per NIST SP 800-63B AAL3, in practice FIDO2/WebAuthn with hardware keys (YubiKey, SoloKey, Titan) or Passkeys with platform attestation. Structurally protects against phishing, AiTM proxy attacks and replay.
In practice
2026 logic: privileged accounts need phishing-resistant MFA. Standard users at least TOTP. SMS MFA is increasingly rejected in regulated industries.
Related terms
Passkeys
Phishing-resistant authentication credentials per WebAuthn/FIDO2 that keep private keys on the device and are unlocked biometrically or by PIN. Replace classic passwords and SMS OTP.
FIDO2
Open authentication standard of FIDO Alliance and W3C, comprising WebAuthn (browser/platform interface) and CTAP2 (device protocol). Foundation for phishing-resistant MFA and Passkeys.
IAM (Identity and Access Management)
The stack of systems that governs who has access to which systems under which conditions. IAM covers authentication, single sign-on, lifecycle management, access governance (IGA) and privileged access management (PAM), and is the most commonly breached control in enterprise environments.
Zero Trust
A security model built on the principle that no user, device or network location is trusted by default. Access is continuously verified against identity, device posture, context and policy, regardless of whether the request comes from inside or outside the corporate network.
MDR (Managed Detection and Response)
A service that provides outsourced 24/7 monitoring, detection and response on top of an EDR or XDR platform. MDR replaces the need to staff a full in-house security operations centre while keeping incident ownership internal.
AI Act Conformity Assessment
Procedure to demonstrate that a high-risk AI system complies with the EU AI Act before being placed on the market or put into service. Mandatory for all Annex III high-risk systems from 2 December 2027 (postponed from the original 2 August 2026 by the Digital Omnibus, Regulation (EU) 2026/1744).
AI Act Risk Categories
Four-tier classification under the EU AI Act: prohibited (Art. 5), high-risk (Annex I/III), limited risk (Art. 50 transparency), minimal risk. Classification is the first duty; it must be documented and defensible.
Audit-ready decision
A decision whose record is structured, evidence-backed and stakeholder-signed to a level that a third-party auditor, a supervisor or a board reviewer can reconstruct the reasoning without interviewing the original team.