Requirement:

The asset owner shall have policies and procedures related to using MFA by devices that support interactive human user login for remote access or when they are located in public access areas.

Guidance: