What is multi-factor authentication (MFA) and why is it non-negotiable?

Multi-factor authentication (MFA) requires a second form of verification beyond just a password to log into an account, typically a code from an authenticator app, a push notification approval, or a hardware key. It's widely considered the single highest-impact, lowest-effort security control available, blocking the vast majority of account-takeover attempts even when a password has been compromised.

Why Passwords Alone Are No Longer Enough

Passwords get compromised constantly, through phishing, through unrelated third-party data breaches exposing reused credentials, through weak or guessable choices. A password, no matter how strong, is a single point of failure, once an attacker has it, they have full access. MFA adds a second, independent barrier that a stolen password alone doesn't defeat, since the attacker also needs the second factor, typically something only the legitimate user physically has.

Which Accounts Genuinely Need This Most

• Email, the highest priority of all, since a compromised email inbox is frequently the launching point for further attacks (password resets on other services, invoice fraud targeting your clients)
• Banking and accounting platforms, direct financial exposure if compromised
• Cloud admin accounts (Microsoft 365, Google Workspace admin), since compromising an admin account can expose or compromise everything else in the organisation
• Remote access and VPN, a common target for attackers seeking network entry
• Any system holding client or customer personal information

Authenticator Apps Versus SMS Codes

SMS-based verification codes are better than no MFA at all, but they're the weakest form, vulnerable to SIM-swap attacks where an attacker fraudulently ports a victim's number to intercept codes. Authenticator apps (generating time-based codes locally on a phone) or push-notification approval are meaningfully more secure and are the recommended default wherever a service supports them.

Addressing the Common Objection: "It's Annoying"

MFA does add a small amount of friction to logging in, a genuine but minor inconvenience weighed against the very real cost of an account takeover. Most modern implementations also support "remember this device" options that reduce repeated prompts on trusted devices, meaningfully reducing the day-to-day friction while keeping the protection intact.

Why This Is Specifically Flagged as a POPIA Safeguard

POPIA requires reasonable technical and organisational safeguards protecting personal information you hold. In the event of a breach investigation, the absence of MFA on key systems is one of the more straightforward gaps to identify and criticise, since it's a well-known, low-cost, widely available control. Having it in place is meaningful, demonstrable evidence of reasonable safeguards.

Rolling It Out Without Disruption

A staged rollout, starting with the highest-risk accounts (email, admin accounts, financial systems) before extending broadly, with clear staff communication about why it matters, tends to land far better than an abrupt, unexplained mandate across every system simultaneously.

Our Approach

We treat MFA enforcement as a foundational, non-negotiable safeguard across every managed environment, prioritising email and admin accounts first, and helping select the right authentication method (authenticator app over SMS wherever supported) to balance genuine security against practical day-to-day usability for your team.