3.5.3
3.5.3
Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.
-
5.5.2.1 Organizations shall implement multi-factor authentication or document all instances where they cannot or make the business decision not to do so.