Skip to main content
U.S. flag

An official website of the United States government

Dot gov

The .gov means it’s official.
Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you’re on a federal government site.

Https

The site is secure.
The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.

Multifactor Authentication for E-Commerce: NIST Publishes Cybersecurity Practice Guide SP 1800-17

NIST has published Cybersecurity Practice Guide Special Publication (SP) 1800-17, "Multifactor Authentication for E-Commerce: Risk-Based, FIDO Universal Second Factor Implementations for Purchasers"

As retailers in the United States have adopted chip-and-signature and chip-and-PIN (personal identification number) point-of-sale security measures, there have been increases in fraudulent online card-not-present electronic commerce (e-commerce) transactions.

The National Cybersecurity Center of Excellence (NCCoE) at NIST built and documented a security architecture that demonstrates implementations of multifactor authentication (MFA) for consumers who shop online and for e-commerce platform administrators who operate the systems. The NCCoE also implemented a logging and reporting dashboard to display authentication-related system activity for the security architecture.

This new Cybersecurity Practice Guide, NIST Special Publication (SP) 1800-17, demonstrates how online retailers can implement open, standards-based technologies to enable Universal Second Factor (U2F) authentication by consumers at the time of purchase when risk thresholds are exceeded. The example implementations outlined in the guide encourage online retailers to adopt effective MFA implementations by using standard components and custom applications that are composed of open‑source and commercially available components.

Released July 30, 2019, Updated August 27, 2019