Multiple authentication — often abbreviated as MFA, an additional check alongside the password, for example a code on the phone — is not explicitly stated as a requirement in the NIS2 Directive or the Cybersecurity Act. What is stated, in the duty of care under Article 21, is that organizations take appropriate technical and organizational measures for, among other things, access control. For most office systems, cloud applications and remote access in the metals and manufacturing industry, this means in practice almost always: yes, multiple authentication belongs there. For machines and control systems on the production floor, this is more nuanced, and this article goes further into that.
The difference lies in what a system is technically capable of and what the risk is if a password alone proves insufficient. A login portal for remote work or cloud administration can almost always accommodate an extra verification step. A twenty-year-old PLC console on the production floor often cannot, and then the question shifts from "MFA or not" to "what other measure compensates for this".
What the duty of care expects from you
The duty of care does not list a fixed set of products or brands. Supervisory authorities and the directive itself speak of measures that fit the risks, the state of the art and the costs of implementation. Access control is one of the recurring topics here: who may access what, how is that checked, and what happens if a password is stolen or guessed. Multiple authentication is currently one of the most common ways to answer that question, and therefore appears again in almost every implementation of this measure that we encounter — also from supervisory authorities in other Member States. How this has been implemented precisely in your country, and what further guidance the supervisory authority provides, you can check via review the implementation by subject.
Where multiple authentication is usually expected
In a metals company or manufacturing business, the places where this is most obvious are often the same: access to the cloud environment and administration, staff inboxes, remote access via VPN for those working remotely, and above all accounts with administrative rights — the IT administrator, the ERP system administrator, the person who can access the backups. Precisely these administrative accounts are attractive to an attacker, because one stolen password immediately gives access to much more than one mailbox. Clients sending a security questionnaire almost always ask explicitly here, and an empty answer to that question is usually harder to explain than an honest "not yet everywhere, with this timeline".
Where production systems call for a different approach
The production floor is a different matter. A CNC machine, a SCADA system or a PLC that lasts for decades was often not built with a login screen that supports a second verification step. Here the duty of care does not replace the impossible with an obligation, but shifts attention to other, supplementary measures: isolating the system in a separate network segment, restricting physical access to the control room, and clearly recording who had access to which machine and when. Segmentation — separating the production network from the office network — is in such cases often the measure that fills the gap that multiple authentication closes elsewhere. Where a machine is connected to the corporate network, for example for remote monitoring or software updates, that connection itself counts as a risk that requires attention, even though that changes nothing about the technology of the machine.
How you make this distinction in practice
A useful first step is to draw up an overview of all systems that provide access to business data or production processes, and for each system ask: can this technically support multi-factor authentication, and if not, what do we implement instead. That overview is precisely where a living dossier proves its value, because one answer from today can change due to a software update tomorrow. Whether your organisation itself falls under the care duty, or whether you receive this question because a client requires it of you, you find out in five questions where you standcan. answers to frequently asked questions are ready.
Multi-factor authentication is therefore not a tick box that looks the same everywhere, but a measure that takes a different form for each system. For your own situation, and for the question of whether a specific exception for your machines is defensible against a client or competent authority, legal advice or consultation with the competent authority remains the appropriate course — secria.eu describes what is applicable and helps you document it, but does not make judgements about your individual situation.
Do you want this overview shown for your own business, including the systems that apply and do not apply to you? Take the free quick-scan or read through the topics first.