A layered security control requiring users to provide at least two distinct methods of verification before accessing systems or data. Common factors include something you know (a password), something you have (a phone or token), and something you are (biometrics). MFA dramatically reduces the risk of unauthorized access, even if one factor—such as a password—is compromised.