Two-factor authentication (2FA)

How it plays out on a deal

Stolen or reused passwords are the most common way into business systems, and data rooms are no exception. A second factor blocks most of those attempts. For a room holding deal documents it should be a minimum, not an option.

The setting that matters is enforcement. Many platforms offer two-factor login but leave it to each user to switch on. Sellers should be able to require it for everyone in the room, or at least for every outside party, and choose which methods count.

What to check in a review or demo

1. 1Whether administrators can require two-factor login for all users in a room.
2. 2Which methods are accepted, and whether text message codes can be excluded.
3. 3How a locked-out user regains access, and whether that path is logged.

Read alongside

• Single sign-on (SSO)Logging in to the data room with an existing company identity, through a provider such as Microsoft Entra ID or Okta, usually over the SAML or OpenID Connect standards.
• IP allowlistingRestricting room access to approved network addresses, such as a firm's office or VPN ranges, so logins from anywhere else are refused.
• Audit trailThe room's running log of who did what and when.
• Principle of least privilegeThe security rule that each user should get only the access needed for their task, for only as long as they need it.

Where this comes up on Data Room Review

• How we score security posture
• Best data rooms for enterprise