Statewide Personnel Policy No. 5

Home / Division Offices / Office of Human Resources / Policies / Statewide Personnel Policies / 5. Statewide Multi-Factor Authentication Policy

Statewide Personnel Policy Number 5, Statewide Multi-Factor Authentication Policy

Effective Date, July 1, 2026

Subject: Statewide Multi-Factor Authentication Policy

Authorization: Taylor F. Barras, Commissioner of Administration

I. Policy

The State of Louisiana is committed to protecting the confidentiality, integrity, and availability of State systems, applications, networks, and data (“State Systems”). As cyber threats continue to evolve, Multi-Factor Authentication (MFA) is a critical security control that helps prevent unauthorized access to State resources and reduces cyber risk.

Uniform implementation of MFA requirements across State agencies promotes consistent security practices, ensures compliance with applicable security standards and regulatory requirements, and strengthens the State’s overall cybersecurity posture.

II. Purpose

The purpose of this Policy is to establish statewide requirements for the implementation and use of MFA when accessing State Systems. MFA strengthens authentication by requiring more than one form of verification before access is granted.

The use of MFA significantly reduces the risk of unauthorized access caused by compromised credentials, phishing attacks, password reuse, or other credential-based threats and is now becoming mandated by Federal regulatory agencies. MFA is a foundational and industry standard control in protecting the confidentiality, integrity, and availability of State resources.

This policy establishes the requirements for MFA deployment and clarifies the acceptable methods for second factor authentication, including the use of authentication applications installed on personal mobile devices.

III. Applicability

This policy applies to all state departments, agencies, boards, and commissions under the Governor's authority which includes:

All employees, contractors, consultants, and third-party personnel,
All State Systems that access or process State data,
On-premise and cloud-based State Systems, whether accessed remotely or internally.

IV. Definitions

Authentication: The process of verifying the identity of Users, devices, or systems prior to granting access to State Systems, applications, or data. Authentication mechanisms confirm that the entity requesting access is the legitimate owner of the credentials being presented. Authentication methods may include passwords, cryptographic tokens, biometric identifiers, or multi-factor authentication mechanisms that combine two or more independent verification factors.
Authentication Application (Authenticator): A software application used to generate one-time passcodes or push authentication requests used as a second factor of authentication.
Confidential Data: Confidential Data is data that the unauthorized disclosure of could seriously and adversely impact an Agency, third party, suppliers, individuals, or the State of Louisiana. Additionally, Confidential Data has been specifically excluded or granted exemption within the State’s Public Records Law.
Multi-Factor Authentication (MFA): An authentication method that requires two or more independent credentials from different categories, including something the User knows, something the User has, or something the User is.
Personal Device: A mobile device owned by the User, including smartphones or tablets, that may be used for multi-factor authentication purposes.
Restricted Data: Restricted Data is data that requires strict adherence to legal obligations such as Federal, State, or local law, specific contractual agreements, or data specifically designated as Restricted Data in applicable state or Agency policy. The unauthorized disclosure of Restricted Data is expected to have a severe or catastrophic adverse effect on an Agency, partners, individuals, or the State of Louisiana. Additionally, Restricted Data has been specifically excluded or granted exemption within the State’s Public Records Law
Second Factor: An additional authentication element required after the primary credential (e.g., password).
Technically Feasible: A system, application, or service supports multi-factor authentication either natively or through integration with an enterprise authentication service without requiring substantial redevelopment, or replacement.

V. Multi-Factor Authentication Control Policy

A. MFA Requirement

All Users accessing State Systems, applications, or services must authenticate using multi-factor authentication where Technically Feasible. For exception requests, see Exceptions.

MFA shall be required for:

Remote access to State Systems,
On-premise access to State Systems,
Non-Privileged and Privileged access to systems containing Confidential or Restricted Data,
Privileged or administrative accounts,
Access to cloud services or externally accessible systems, and
State Systems designated by the OTS State Chief Information Officer (CIO), Chief Information Security Officer (CISO), Information Security Team (IST), or Agency equivalents.

B. Second Factor Authentication Methods

The State may utilize several MFA mechanisms including, but not limited to:

Authentication applications generating time based one-time passcodes,
Push notification authentication,
Smart cards or cryptographic certificates, and
Biometric authentication mechanisms.

Authentication applications installed on mobile devices will be the preferred method for the second authentication factor due to security, usability, and operational efficiency.

Note: While voice and SMS-based MFA may still be permitted in limited use cases such as ADA accommodations, these methods are no longer considered secure authentication factors and have been deprecated in federal guidance and standards.

VI. Use of Personal Mobile Devices for MFA

A. Mandatory Enrollment

Enrollment in MFA is a condition of access to State Systems. Failure to enroll in MFA may result in denial of access to State Systems. Where personal mobile devices are utilized for MFA, Users shall install the approved authentication applications on the personal mobile devices. If the agency issues a State mobile device to a User, based on internal policy and procedure, the State device will be set up for MFA.

B. Acceptable Use of Personal Devices

The use of a personal device for MFA authentication is limited solely to generating or approving second factor authentication requests.

The authentication application installed on a personal device does not:

Access State data,
Store State information,
Monitor personal device activity, or
Provide the State with administrative control over the device.

The application functions only as a mechanism for confirming the identity of the User during authentication.

C. Privacy Protections

Installing an authentication application on a personal device does not grant the State access or visibility to the personal device.

The State does not have the ability to:

View personal files or communications,
Track location information,
Monitor phone calls, messages, or applications,
Manage, control, or remotely wipe the personal device, and
Install additional software on the device.

D. Public Records Considerations

Personal mobile devices used to support MFA remain the sole property of the User. The installation or use of an MFA application on a personal device does not, by itself, create a State or public record. Furthermore, the use of a personal mobile device exclusively for MFA purposes does not subject the device or its contents to disclosure under the Louisiana Public Records Law (La. R.S. 44:1 et seq.).

Additionally, pursuant to La. R.S. 44:1(A)(2)(b), temporary codes produced by MFA authentication applications are excepmted from the definition of a public record.

E. Alternative Authentication Methods

In circumstances where a User is unable to provide a device to function as the second factor of authentication, alternative authentication methods may be considered. Users must coordinate with their Agency’s Appointing Authority (or designee) to determine an appropriate alternative authentication solution. Such alternatives may include, but are not limited to:

State-issued mobile devices,
Hardware authentication tokens,
Other authentication mechanisms approved by the Agency’s Information Security Team or equivalent.

Agencies are responsible for evaluating operational needs and coordinating with their Information Security Team (or equivalent) to ensure that any alternate authentication method provides an equivalent level of security and complies with State policy requirements.

VII. Enforcement

Failure to comply with this policy may result in:

Suspension or removal of system access,
Disciplinary action in accordance with State and/or agency policies, and/or
Additional corrective actions as deemed appropriate by the agency.
For contractors and contracted personnel, actions up to and including contract termination

VIII. Exceptions

Any exception to this policy must be formally documented, including a business justification, risk assessment, and identification of compensating security controls. Exception requests must be reviewed and approved by the Agency’s Appointing Authority (or designee). Agencies supported by the Office of Technology Services (OTS) shall submit Agency approved exceptions to the OTS State CIO (or designee) for final review and approval. Exceptions shall not be granted solely for convenience or cost avoidance.

A. Record Keeping

Agencies shall develop and maintain internal documentation outlining specific exceptions for personal mobile device usage for MFA, including when state-issued devices may or may not be provided as substitutes.