← CIS Controls v8 in plain English

6.5 IG1

Control 6 / Access Control Management

Require MFA for Administrative Access

Think of it likeThe account that can rewire the whole house needs two proofs of identity before it turns anything, not just a password.

In plain English

The most powerful admin accounts require a second verification step, because these are the logins an attacker most wants to seize.

Related CSF subcategories (unofficial mapping)