# SEC02-BP01: Use strong sign-in mechanisms

## Description

MFA, strong passwords, passkeys.

## Implementation Guidance

- Enforce MFA for all users
- Strong password requirements
- Passkey/WebAuthn support
- Risk-based authentication
- Brute force protection

## Risk Level

Critical - Weak authentication leads to account compromise.
