Authentication in document management is the first control that separates an organisation’s information from those who should not see it. For this reason, when someone steals or guesses a user’s credentials and the password is the only proof of identity, the entry barrier has already failed and every control that follows becomes vulnerable.
In brief
- Most unauthorised access starts with compromised credentials, through phishing, password reuse or data leaks from other services.
- Multi-factor authentication adds an extra proof of identity and greatly reduces the impact of a compromised password.
- The GDPR requires security measures appropriate to the risk, and NIS2 expressly mentions multi-factor authentication among the measures that covered entities should consider.
- Not all factors are equal: SMS codes are better than nothing, but physical keys and passkeys offer much stronger protection against phishing.
Why authentication is the most exposed point
A document management platform brings together contracts, worker documentation, personal data and technical information. For an attacker, a single account with broad permissions may therefore be worth more than any technical vulnerability. In addition, access with valid credentials is hard to detect because, at first glance, it looks like a legitimate user working normally.
Attackers usually compromise credentials in familiar ways: phishing emails that imitate login pages, reused passwords that already appeared in leaks from other services and weak passwords that offer little resistance to automated attempts. Therefore, relying on the password alone is a high-risk choice today.
What the frameworks say
| Framework | What it establishes |
|---|---|
| GDPR, Article 32 | Technical and organisational measures appropriate to the risk to ensure the confidentiality, integrity and availability of personal data |
| NIS2 Directive, Article 21 | Includes, among risk management measures, the use of multi-factor authentication or continuous authentication, where appropriate |
| ISO/IEC 27001 | Provides for secure authentication controls and access rights management within the information security management system |
None of these frameworks imposes a specific product. However, they all require the organisation to show that it chose controls proportionate to the risk, and strong authentication is usually one of the first.
Authentication factors: How to compare them
| Factor | Advantages | Limitations |
|---|---|---|
| Password | Universal and simple | Vulnerable to phishing, reuse and automated attacks |
| SMS code | Easy to adopt | Exposed to phone number hijacking and real-time phishing |
| Authenticator app | Does not depend on the mobile network and is free | Sophisticated fake pages can still get around it |
| Physical key or passkey | Resistant to phishing because it checks the genuine site | Requires device and recovery management |
In general, the choice should depend on the profile: regular users can use an authenticator app, while administrators and accounts with access to sensitive data justify phishing-resistant factors.
Authentication in document management: Where to apply it
- Internal users. For example, HSE, procurement and human resources teams who access workers’ personal data.
- Contractors. They submit and consult documentation, but often do so from devices that the organisation does not control.
- Platform administrators. Since they hold the broadest privileges, they should always use the strongest factor available.
- Integrations. Connections between systems should use their own technical credentials, with minimum permissions and periodic rotation.
Passwords: What has changed in good practice
For years, password rules focused on complexity and frequent changes. However, current reference recommendations, such as those from NIST in the United States, favour a different approach: long passwords, such as easy-to-remember phrases, checks against lists of passwords that have already leaked and changes only when there is a suspicion of compromise. As a result, users stop creating predictable variations of the same password every quarter.
Likewise, a password manager makes it possible to use unique credentials for each service, which stops a data leak on another site from opening the door to the document platform. In this sense, organisations should design the password policy and multi-factor authentication together, not as independent measures.
Authentication and permissions: Two sides of the same control
Authentication answers the question “who is this person?”. Permissions, on the other hand, answer another one: “what can this person see and do?”. Strong authentication with excessive permissions remains a risk, because a compromised or misused legitimate account reaches more information than it needs.
In contractor document management, for example, a contractor should only see the documentation of their own company and workers. Similarly, an analyst at one facility does not usually need access to data from other regions. Therefore, the principle of least privilege reduces the impact of any authentication failure.
Example: Unauthorised access that never happened
A procurement officer receives an email that imitates the document platform’s login page and enters her password. Hours later, someone tries to log into the account from another country. Because the account requires a second factor, the attempt fails and the system logs the event. Next, the IT team receives the alert, forces a password change and confirms that no one accessed the data. Without the second factor, the attacker would have reached the documents of hundreds of workers without any obstacle.
Implementation in five steps
- Inventory accounts and profiles. First, identify who has access, to what information and with what permissions.
- Define the policy by profile. Then, decide which factor to require for each type of user.
- Prepare recovery. In addition, define how a user regains access after losing their phone or key, without opening a back door.
- Communicate and train. Explain to users why the change is happening and teach them to recognise phishing attempts.
- Monitor. Finally, track failed attempts, unusual access and accounts without strong authentication.
Contractor authentication: Specific precautions
Contractors are often the hardest group of users to manage. On the one hand, they change frequently and work for several clients. On the other, they access the platform from computers and phones that the organisation does not control. Therefore, a few precautions make a difference:
- each person at the contractor company should have their own account, instead of one account shared by the whole team;
- the contract should require the contractor to report immediately when staff with access leave;
- the platform should automatically suspend accounts with no activity for a defined period;
- the access recovery process should confirm identity with the manager responsible at the contractor company.
In this way, the organisation keeps control over who accesses its information, even when those people are not part of its staff.
Common mistakes
- Permanent exceptions. Accounts “temporarily” exempt from strong authentication tend to stay that way for years.
- Shared accounts. Each person should have their own account, so that access remains traceable.
- Weak recovery. A recovery process based only on email cancels out the benefit of the second factor.
- Late deactivation. Organisations should immediately deactivate the accounts of employees or contractors who have left.
Frequently asked questions
Does multi-factor authentication slow down access?
Slightly, at login. However, many solutions let you trust a device for a defined period, which reduces the inconvenience without giving up protection.
Is it mandatory for contractors who use the platform?
It depends on the organisation’s policy and on the risk. Even so, when contractors access personal data or sensitive documentation, the recommendation is to apply the same standard as for internal users.
Which indicators should we monitor?
The most useful are the percentage of accounts with strong authentication, the number of failed access attempts, access from unusual locations and the average time to deactivate accounts. With these indicators, management can check whether teams actually apply the policy.
Is biometrics a good option?
It can be, especially when it unlocks a key stored on the device itself, as happens with passkeys. However, biometric data is especially sensitive personal data, so the organisation should prefer solutions in which this data never leaves the user’s device.
Questions for senior management
- What percentage of our document platform accounts use strong authentication?
- Do administrators use phishing-resistant factors?
- How quickly do we deactivate the accounts of people who stop working with us?
Conclusion
In short, authentication in document management is a control that is simple to explain and has a major impact on risk. When combined with appropriate permissions and access logs, it turns the document platform into a repository that the organisation can protect and audit.
The investment is small compared with the cost of unauthorised access to worker documentation, contracts or technical information. Thus, starting with the most privileged accounts and gradually extending to all users is generally the fastest way to reduce risk without disrupting operations.
AISP-GEDOC supports companies with document management on digital platforms, including the definition of profiles, permissions and access rules.
Sources
- Regulation (EU) 2016/679 (GDPR), EUR-Lex
- Directive (EU) 2022/2555 (NIS2), EUR-Lex
- Portuguese National Cybersecurity Centre (CNCS)
Further reading: Document management: A complete guide for companies.