The short definition

Single-factor access control checks one credential: a badge tap, a PIN, a fingerprint read. Compromise that factor and the door opens. MFA requires two or more credentials from different categories. A stolen badge alone produces a denied attempt with audit trail; the attacker also needs the user's PIN or fingerprint to get in.

The math: if a single factor has a 1-in-10,000 chance of compromise, two independent factors compound to 1-in-100,000,000. Real-world reduction is smaller because some factors share failure modes (steal a phone, often get the PIN too), but the order-of-magnitude improvement holds.

The three factor categories

  • Something you have. Physical possession. Prox cards, smart cards, mobile credentials, FIDO2 hardware keys. Lost or stolen, the factor is compromised.
  • Something you know. Memorized secret. PIN, password, passphrase. Vulnerable to shoulder surfing, phishing, and brute force on weak PINs.
  • Something you are. Biometric. Fingerprint, face, iris, palm vein. Hard to steal but not impossible (face from photos, fingerprints from latent prints). See the biometric authentication entry.

A fourth category sometimes mentioned: somewhere you are (location-based). Used in cyber MFA but rarely in physical access control.

Common physical MFA pairings

  • Badge plus PIN. Most common. Reader has both an RFID antenna and a keypad. Low cost, easy enrollment. PIN is the weakest factor; users share or post-it PINs in shared workspaces.
  • Mobile credential plus phone biometric. The phone unlocks via Face ID or Touch ID, then transmits the credential via Bluetooth or NFC. Strong factor combination because the phone biometric is enforced by the user's own device.
  • Badge plus biometric reader. Reader has both RFID and a fingerprint sensor or face camera. Common at data centers and pharmaceutical clean rooms. Higher hardware cost; slower throughput.
  • Biometric plus PIN. No physical badge. Used at high-security single-door zones where badge management is impractical.

Where MFA is required

  • Data centers and server rooms. SOC 2 Type II auditors expect MFA at any room holding production servers. ISO 27001 Annex A.11 reinforces it.
  • Pharmacy and controlled substances. DEA Schedule II handling rules and Joint Commission standards require dual control on access to controlled-substance storage.
  • CJIS-protected areas. Evidence rooms, criminal-records rooms, and police data centers under FBI CJIS rules. MFA at the door is standard.
  • PCI DSS cardholder data environments. Requirement 9.3 mandates MFA on physical access to cardholder data environments. Backroom server zones at retailers, hotels, and processors.
  • Defense industrial base CMMC environments. Levels 2 and 3 require multi-factor physical access to controlled unclassified information (CUI) zones.
  • Insurance-driven IDF lockup. Cyber-liability insurers increasingly require MFA at IDFs and server closets after major retail breaches were traced to physical access.

Implementation considerations

Three patterns to think through before quoting.

  • Reader hardware. Single-factor readers cost $200 to $500, dual-factor (RFID plus PIN keypad) $300 to $700, biometric-capable $700 to $2,500. Budget at the door count.
  • Throughput at peak hours. MFA slows transit: single-factor RFID averages 0.5 second per entry, badge plus PIN 3 to 5 seconds. Plan for queueing at high-traffic doors during shift starts.
  • Enrollment workflow. Biometric MFA enrolls users at a kiosk or admin terminal, 5 to 10 minutes each. PIN-based MFA enrolls in seconds via the cloud platform.

When to ask Tec-Tel about MFA

MFA is a per-door decision. We'll walk a building, identify the doors that need MFA based on what's behind them, scope the right reader hardware, and tie it into your existing PACS. Free scoping call.