Setting up two-factor authentication

This product asks whether you enforce multi-factor authentication as part of the questionnaire itself — 800-171 3.5.3, ISO 27001 A.5.17. Turning it on here is worth doing before you answer that question rather than after.

How to set it up

1. In Settings, under Two-Factor Authentication, click "Set up."
2. Scan the QR code with an authenticator app and enter the six-digit code it shows to confirm.
3. Save the recovery codes shown at that point somewhere safe — each one works once, and they are the only way back in if you lose the device your authenticator is on.

How to use it

Once enabled, sign-in asks for the six-digit code after your password. A spent recovery code cannot be reused; turning two-factor off again costs one of the remaining codes, so it isn't something a compromised session can quietly undo.