Spain’s CPSTIC qualification gives MFA proof procurement weight

At a glance

What this is: NHI Mgmt Group's analysis, drawing on WatchGuard's blog post: Spain's ENS High qualification for MFA shows that independent government validation can become part of security procurement, not just product marketing.

Why it matters: Identity teams and MSPs need evidence they can defend in questionnaires, proposals, and control reviews when buyers ask whether MFA really withstands credential theft and session abuse.

By the numbers:

• 58% of organizations plan to switch providers within the next three years, according to WatchGuard's MSP Survey 2026.

Context

Security products often claim coverage, but public-sector procurement turns the question into evidence: can an independent authority verify that the control meets a defined security baseline? In Spain, that validation path runs through CPSTIC and the ENS framework, which makes certification part of the buying decision rather than an afterthought.

For identity controls, this matters because MFA is only useful when buyers can distinguish marketing claims from independently tested assurance. Spain’s public-sector model is atypically strict, but it exposes a wider gap in how organisations evaluate login security and supplier trust.

Key questions

Q: How do I prove MFA is trustworthy in procurement reviews?

A: The strongest proof is independent validation against a defined security baseline, ideally from a government catalog, accredited lab, or formal certification body. Buyers should look for evidence that the control was tested by a neutral party, the scope of the validation is clear, and the deployment assumptions match the environment where MFA will be used.

Q: Why do stolen credentials still matter in environments with MFA?

A: Stolen credentials matter because they are often the first step in a chain that ends with social engineering or MFA fatigue. Once the attacker has a valid username and password, they only need one weak factor or one confused user. MFA reduces risk, but it does not remove the value of credential theft as an entry method.

Q: How should security teams secure self-service password reset and account recovery?

A: Use identity proofing before access is restored, not after. Replace security questions and SMS or email OTPs with stronger verification such as document validation, liveness detection, and risk-based escalation for ambiguous attempts. The goal is to confirm a real, present user before the identity lifecycle is reopened.

Q: What is the difference between SSO and MFA in SaaS authentication?

A: SSO and MFA solve different problems. SSO lets users authenticate once through a central identity provider and access approved applications with that identity. MFA strengthens the login itself by requiring an additional proof, such as an authenticator code or SMS challenge. In practice, SSO improves identity governance, while MFA improves resistance to stolen credentials and account takeover.

Technical breakdown

How CPSTIC qualification works as a security gate

CPSTIC is a government catalog rather than a vendor registry. A product must pass evaluation against National Cryptologic Centre requirements in an accredited lab, and the lab documents the findings before the authority decides whether the product qualifies. That means the control is validated against a defined baseline, not asserted by the supplier. For public buyers, the catalog becomes a decision boundary: if the product is not listed, it is not considered acceptable for that security tier. This shifts assurance from self-declaration to external verification.

Practical implication: Treat government qualification as a procurement control and require evidence that the product has been independently evaluated against the target baseline.

Why MFA still matters after password theft

MFA is not a cure for compromised credentials, but it blocks a common next step: turning a stolen password into a valid session. The article points to breach data showing that vulnerability exploitation is now a major initial access path, while stolen credentials remain widely used in government-related breaches. That combination matters because attackers can enter through one weakness and still need authentication to move deeper. MFA raises the cost of that second step by requiring proof beyond the password, especially when paired with phishing-resistant factors.

Practical implication: Place MFA in front of remote access, cloud apps, and privileged sessions where a stolen password would otherwise become usable access.

Why procurement teams need third-party proof for identity controls

When security teams buy identity controls, the real issue is not whether the vendor says the control works. The issue is whether a customer, auditor, or regulator can trust the evidence behind that claim. Public-sector cataloging answers that by tying approval to a specific standard and an independent test process. That creates a reusable trust artifact for sales, assurance, and risk review. It also changes the burden on security teams: they need to ask for external validation of controls that protect the login path, not just functional descriptions. See the Vendor Security Assessment Template.

Practical implication: Build independent certification into vendor assessment criteria for authentication and remote-access controls.

Threat narrative

Attacker objective: The attacker wants to turn an initial foothold into reliable authenticated access that can be used for lateral movement and privilege escalation.

1. Entry occurs through either exploited vulnerabilities or stolen credentials, but the article shows that credential theft still remains a frequent way into government environments.
2. Escalation depends on getting from a password to a valid authenticated session, which is where MFA becomes the deciding control.
3. Impact follows when attackers use that session to move deeper into cloud applications, workstations, or remote access paths.

Breaches seen in the wild

• Poland ArcGIS password leak 2023: An ArcGIS login emailed in 2020 was published from stolen mail in 2023 and still worked, exposing Polish military and infrastructure maps.
• BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Independent validation is becoming a procurement control for identity security. When a public authority evaluates a product against a defined baseline and lists the result in a catalog, the assurance claim changes shape. Buyers no longer have to rely on supplier self-attestation alone, which is especially important for MFA and other controls that sit in the authentication path. The practical conclusion is simple: procurement teams should treat external qualification as evidence, not decoration.

MFA is strongest where it interrupts the conversion of stolen credentials into usable sessions. The article’s breach context matters because it shows that attackers still combine one path in and another path deeper. Identity controls therefore need to be judged on whether they can break that chain at login time, not on whether they merely exist in the stack. For security programmes, the meaningful unit is session protection, not password policy alone.

Credential theft remains a governance problem, not just a detection problem. The credential path persists because many environments still allow reused, phishable, or weakly verified access to become operational access. That is why security questions and other legacy recovery patterns deserve the same scrutiny as MFA itself. If the recovery path is weak, the authentication control is only partially trusted, and the organisation inherits an avoidable access gap.

Gov-grade assurance reshapes how MSPs should present security controls. MSPs often need proof that will survive a customer questionnaire, a risk review, and a procurement challenge. A public-sector qualification gives them a defensible reference point, but only if they use it to discuss control assurance rather than brand value. The practical conclusion is that identity controls should be packaged with evidence, scope, and limits.

What this signals

Procurement-grade assurance is becoming part of identity control design. When buyers can point to external validation, MFA shifts from a claimed feature to a defensible control in assurance workflows. That matters for any programme that has to answer auditor, customer, or public-sector scrutiny without relying on vendor self-attestation.

Credential-to-session conversion is the control point that matters. The modern login stack is vulnerable when one stolen secret can still become a working session. Identity teams should design for that failure mode, because authentication controls are now judged by whether they interrupt usable access, not just by whether they exist.

For practitioners

• Use independent qualification as an evidence requirement Require third-party testing or catalog inclusion for MFA and other authentication controls before approving them in customer-facing proposals.
• Place MFA in front of session creation Enforce MFA on cloud apps, VPN access, workstation logins, and remote desktop sessions where a stolen password would otherwise become a valid session.
• Review credential recovery paths Check that password reset, account recovery, and help desk workflows cannot bypass the same assurance level required at primary login.
• Document assurance for questionnaires Keep a current evidence pack that maps authentication controls to external certification, scope limits, and deployment assumptions.

Key takeaways

• The article shows that public-sector qualification can serve as a trust signal for identity controls, especially when buyers need evidence rather than vendor claims.
• The breach context reinforces that stolen credentials remain a live access path, so MFA still has to break the step from password theft to valid session.
• Security teams should treat certification, recovery flows, and session protection as one governance problem, not three separate ones.

Related NHI Mgmt Group resources: Vendor Security Assessment Template · Security Questions and KBA · AI Security in Government and Public Sector · Poland ArcGIS password leak 2023

Key terms

• Multi-Factor Authentication: Multi-factor authentication requires two or more independent verification factors before access is granted. In practice, it reduces the chance that a stolen password alone will open a system, but it only works well when applied consistently across all high-risk access paths and identity types.
• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Credential Theft: Credential theft is the unauthorized capture of secrets used to authenticate a user or workload, such as passwords, MFA codes, or security questions. In SaaS environments, it usually produces login events that defenders can inspect, but it still becomes dangerous when attackers combine it with token abuse or integration misuse.
• Authenticated Session: An authenticated session is the period after a user, workload, or agent proves identity and is allowed to interact with a system without repeating login checks for every action. In IAM, it binds a verified identity to a time-limited token or session state, enabling access decisions, auditability, and revocation when risk changes.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, IAM, and secrets management. It helps practitioners connect authentication controls to the access paths they are meant to protect.