> For the complete documentation index, see [llms.txt](https://docs.nested-knowledge.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nested-knowledge.com/policies/policies/internal-policies/multi-factor-authentication.md).

# Multi-Factor Authentication

## Purpose

This policy outlines our requirement for secure authentication of users who connect to Nested Knowledge information systems. We are committed to protecting the security, privacy, and integrity of Nested Knowledge information systems by increasing the resiliency of authentication under partially compromised credentials.

**Scope** This policy affects all employees, contractors, consultants, and business partners of Nested Knowledge.

## Internal Company MFA Policy

Nested Knowledge will require multi-factor authentication (MFA) on all internal systems by default. Nested Knowledge will make exceptions on the basis of 1. lack of availability of MFA in the solution 2. low sensitivity data processed. We will evaluate the risk and sensitivity or personal and organizational data, such as personal employee data, user data, intellectual property, and financial information, on an ongoing basis. Evaluation will be based on our data classification system.

### Multi-Factor Authentication For Remote Access

Nested Knowledge has no internal network for employees, therefore multi-factor authentication for remote access is not applicable. All cloud services accessed by Nested Knowledge employees will be configured to require MFA and monitored on a quarterly basis for compliance.

### Multi-Factor Authentication For Financial Information

At present, Nested Knowledge stores financial information via a cloud-based accounting software. Our security measures for protecting such data are determined by the software. At present, it requires MFA of all users. The accounting application is a VeriSign Secured(TM) product, which is the leading secure sockets layer (SSL) Certificate Authority. It uses firewall protected servers and the encryption technology (128 bit SSL).

### Authentication With Client Data

In cases where a client grants Nested Knowledge access to data with the explicit requirement of multi-factor or other authentication in order to access the data, we will adhere to the level of authentication required by the client. Where clients upload data to the Nested Knowledge platform or to any cloud managed by Nested Knowledge without explicit requirement, we will adhere to the level of authentication outlined in this policy.

### Cloud Based Applications

Our most sensitive systems, namely our production, cloud resources require MFA; we require physical token or authenticator app-based MFA in these environments, and compliance is monitored in an ongoing, automatic manner and additionally via manual quarterly audit.

## Application MFA Policy

Multi-factor authentication has not been implemented for Nested Knowledge’s client-facing software product using U/P signin. To gain MFA, users are encouraged to leverage SSO (an Enterprise feature) or Google Sign In (available to all tiers).

## Revision History

| Author     | Date of Revision/Review | Comments                                   |
| ---------- | ----------------------- | ------------------------------------------ |
| K. Cowie   | 10/25/2024              | Revised                                    |
| K. Cowie   | 11/24/2021, 10/06/2023  | In progress.                               |
| K. Holub   | 12/12/2025              | Reviewed and Updated for current practices |
| K. Kallmes | 11/26/2021              | Draft approved                             |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.nested-knowledge.com/policies/policies/internal-policies/multi-factor-authentication.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.