MFA in DORA and NIS2 compliance: Why strong authentication is essential

MFA in the context of DORA and NIS2

The Role of MFA in DORA and NIS2 Compliance

Strong authentication is no longer optional. It’s now a global regulatory expectation.
In Europe, the Digital Operational Resilience Act (DORA) and the Network and Information Systems Directive (NIS2) set a high bar for cybersecurity. In the United States, regulations like the FTC Safeguards Rule and the New York Department of Financial Services (NYDFS) Cybersecurity Regulation impose equally strong authentication requirements.

Across these frameworks, Multi-Factor Authentication (MFA) and increasingly phishing-resistant, passwordless authentication is recognized as a core control for preventing breaches, protecting sensitive data, and maintaining operational resilience.

Analysis of DORA and NIS2 Regulations in the Context of Enterprise Cyber Security in the EU.

Understanding DORA and NIS2

DORA applies to EU financial institutions and their ICT third-party providers. It focuses on ensuring resilience to cyber threats and operational disruptions through robust risk management, incident reporting, and strong authentication.

NIS2 applies to organizations in critical sectors such as energy, healthcare, transport, finance, and public administration. It mandates enhanced cyber hygiene, incident reporting, and zero-trust frameworks.

Both regulations do not prescribe specific tools but explicitly highlight strong authentication and MFA as key measures.

U.S. Regulations on Strong Authentication

FTC Safeguards Rule

Applies to financial institutions under the Gramm-Leach-Bliley Act (GLBA). The 2023 updates explicitly require Multi-Factor Authentication for anyone accessing customer information systems.

NYDFS Cybersecurity Regulation

Since 2017, the NYDFS Cybersecurity Regulation has required covered financial institutions to implement MFA for:

  • Access to internal systems containing nonpublic information
  • Remote access to corporate networks

Recent updates expand MFA requirements to more systems and user categories.

CISA Guidance

The Cybersecurity and Infrastructure Security Agency (CISA) strongly recommends phishing-resistant MFA for all critical infrastructure sectors, emphasizing:

  • FIDO2 passkeys
  • Hardware security keys
  • Certificate-based authentication
Who is responsible for complying with DORA

Why MFA Is Central to All These Regulations

Across both EU and U.S. frameworks, MFA is a foundational security control because it:

  • Reduces the risk of phishing, credential theft, and account takeover
  • Enforces zero-trust principles by validating every access request
  • Supports compliance with multiple global cybersecurity regulations

DORA: Strong Authentication in the Financial Sector

Under DORA, financial entities must:

  • Implement strong workforce and customer authentication
  • Adjust controls proportionally to size, risk profile, and complexity
  • Be able to prove compliance during inspections
Who is responsible for complying with NIS2 and DORA

NIS2: Sector-Wide Security and Zero Trust

NIS2 mandates:

  • Regular software patching and secure configuration
  • Network segmentation
  • Identity and Access Management (IAM) with MFA
  • Security awareness training

Implementing Strong Authentication for Compliance

Regulatory-compliant authentication typically includes at least two factors:

  • Knowledge – Password or PIN
  • Possession – Hardware token, security key, smartphone
  • Inherence – Biometric data such as fingerprint or facial recognition
Do You Serve Banks or Insurers? You Need DORA Compliance – Secure Your Future Now!

Secfense Solutions for Global Compliance (EU + U.S.)

  • Phishing-Resistant MFA – Remove passwords as an attack vector using passkeys and FIDO2.
  • Passwordless for Workforce (IAM) – Secure employee logins across all systems.
  • Passwordless for Customers (CIAM) – Provide secure, password-free access on any device.
  • Legacy App Protection – Add MFA and policy-based controls to any app without code changes.
  • Privileged Access & Microauthorizations – Secure high-risk actions with per-action verification.
  • Secure Remote Access (VPN, Citrix, OWA) – Make systems invisible to unauthorized users.
  • Zero Trust Authentication – Assume breach and verify every request.
  • Regulatory Compliance Alignment – Out-of-the-box support for DORA, NIS2, PSD2, FTC Safeguards Rule, and NYDFS Cybersecurity Regulation.
Do you know how the new Digital Operational Resilience Act (DORA) and The NIS2 (Network and Information Security) Directive regulations will affect the future of businesses in Europe

Compliance Dates and Continuous Requirements

  • NIS2 enforcement – October 17, 2024
  • DORA enforcement – January 17, 2025
  • FTC Safeguards Rule MFA deadline – June 9, 2023 (already in effect)
  • NYDFS MFA requirements – In effect since 2017, with ongoing expansion

Compliance is not a one-time exercise it requires continuous monitoring, policy updates, and adaptable authentication.

📩 Contact Us to Discuss Your Compliance Plan

What to Expect

  • A short conversation to understand your requirements and security goals.
  • Discussion of commercial terms for relevant Secfense solutions such as Passwordless IAM, CIAM, Legacy App Protection, or Privileged Access controls.
  • Agreement on next steps – proof of concept, contract details, or rollout plan.

Who It’s For

  • Prospects ready to scope a project and discuss budgets.
  • Existing customers expanding Secfense coverage to more systems.
  • Organizations in the decision/purchase stage after reviewing our solution areas.

Contact Secfense Today →

Featured Articles

Keep In Touch

Read More

DORA and NIS2 are here – are you ready for the enforcement era?

The time for preparing is over. DORA and NIS2 are no longer “upcoming regulations.” They’re here, written into law, and enforcement has already started across…
Avatar of Antoni Sikora Antoni Sikora

READ TIME 2 MIN

How to cut IAM costs and reduce risk without code changes

Passwords continue to be one of the biggest liabilities in enterprise identity and access management (IAM). While much of the conversation focuses on security risks…
Avatar of Antoni Sikora Antoni Sikora

READ TIME 2 MIN

How Secfense enables passkey-based password recovery

In our previous article A Pragmatic Path to Phishing-Resistant Self-Recovery we explained why passwordless doesn’t have to be an all-or-nothing switch. Instead of replacing passwords…
Avatar of Antoni Sikora Antoni Sikora

READ TIME 3 MIN

Testimonials

We are faced with new challenges every day. We must always be one step ahead of the attackers and know what they are going to do before they do it. We are convinced that the User Access Security Broker will bring security to a new level, both for those working at the office and from home. For us, working with Secfense is an opportunity to exchange experience with developers who put great value on out-of-the-box thinking.

Krzysztof Słotwiński

Business Continuity and Computer Security Officer

BNP Paribas Bank Poland

As part of the pre-implementation analysis, we verified that users utilize a wide range of client platforms: desktop computers, laptops, tablets, smartphones, and traditional mobile phones. Each of these devices differs in technological advancement, features, and level of security. Because of this, and also due to the recommendation of the Polish Financial Supervision Authority (UKNF), we decided to introduce additional protection in the form of multi-factor authentication mechanisms based on FIDO. As a result, users of our applications can log in safely, avoiding common cyber threats such as phishing, account takeover, and theft of their own and their clients’ data.

Marcin Bobruk

CEO

Sandis

We are excited to partner with Secfense to enhance our user access security for our web apps. By integrating their User Access Security Broker, we ensure seamless and secure protection for our applications and systems, delivering superior security and convenience to our customers.

Charm Abeywardana

IT & Infrastructure

Visium Networks

Before investing in Secfense, we had the opportunity to talk to its existing clients. Their reactions were unanimous: wow, it’s so easy to use. We were particularly impressed by the fact that implementing their solution does not require the involvement of IT developers. It gives Secfense a huge advantage over the competition, and at the same time opens the door to potential customers who so far were afraid of changes related to the implementation of multi-factor authentication solutions.

Mateusz Bodio

Managing Director

RKKVC

Even when the network and infrastructure are secured enough, social engineering and passwords can be used to gain control of the system by attackers. Multifactor authentication is the current trend. Secfense addresses this and allows you to build zero trust security and upgrade your current systems to passwordless applications within minutes, solving this problem right away,” said Eduard Kučera, Partner at Presto Ventures and cybersecurity expert – former Director in hugely successful Czech multinational cyber security firm Avast.

Eduard Kučera

Partner

Presto Ventures

One of the biggest challenges the world is facing today is securing our identity online. That’s why we were so keen to have Secfense in our portfolio. They make it possible to introduce strong authentication in an automated way. Until now, organizations had to selectively protect applications because the deployment of new technology was very hard, or even impossible. With Secfense, the implementation of multi-factor authentication is no longer a problem, and all organizations can use the highest standards of authentication security.

Stanislav Ivanov

Founding Partner

Tera Ventures