Is multi-factor authentication used for access to business systems?

MFA is the explicit tenth measure of Article 21(2)

Yes, this question concerns a literally named component of the NIS2 list: Article 21(2)(j) mentions "the use of solutions for multi-factor authentication or continuous authentication" by name. This makes this question different from most others on such a list — there is no room for interpretation about what is meant, only about whether it has been implemented and where.

The practice lies in the scope, not in the principle. A customer asking whether MFA is used usually means: does this apply to all access to business systems, or only to part of it? MFA on the VPN but not on cloud applications, or on administrator accounts but not on regular users, is a different answer than a simple yes. This component is therefore closely linked to the documented access policy and the management of business resources: without an overview of which systems exist and who has access to them, "is MFA used" is not a yes-or-no question but a question with a percentage in it. Anyone who only knows the answer for their own laptop and not for the server environment is effectively answering about a subset.

Where this appears in the directive: Article 21(2)(j)

Article 21(2) of Directive (EU) 2022/2555 sets out ten measures that entities must take as part of their risk management; point (j) specifically mentions multi-factor authentication or continuous authentication, alongside encrypted communications and secure emergency communications. This measure does not stand alone: paragraph (1) of the same Article requires that the whole is proportionate to the risk, the scale and the likelihood of incidents, which allows room for a phased rollout as long as it is documented in policy. Whether MFA is mandatory for the answering company itself depends on whether the company falls under the directive as an entity — a supplier that does not itself fall under NIS2 only receives this question because its customer does, and the supply chain must be surveyed.