Multi-factor authentication and secured communications

Opening (j) of the duty of care covers two things often named together: multi-factor authentication and secured communication, even when normal channels fail.

What this means in practice

You introduce multi-factor sign-in for users and for remote access, give extra protection to administrator accounts, secure voice, video and text communication, and arrange secured emergency communication for when normal channels go down.

Why this is in the law

The Cyberbeveiligingsbesluit doesn't elaborate this opening in its own article; the duty sits directly in article 21 Cbw and touches the articles on access policy and crisis communication.