Apple is starting to use two-factor authentication for iCloud. The added security appears to be rolling out in phases so some users are beginning to see this feature when they log into iCloud while others may have to wait until it gets deployed for their accounts; we can confirm that it is active on several accounts here at iMore.
With the new two-factor authentication, the only service that doesn't require additional verification is Find my iPhone. This is done so that users of lost or stolen phones can still log in on the web portal to track and hopefully locate their phones. Services that require additional authentication include Mail, Contacts, Calendar, Notes, Reminders, and Apple's productivity suite that includes Pages, Numbers, and Keynote.
Users are asked to "verify their identity" to access those services when they log in. To do this, the service will text a passcode to a specified number that can be used during log in for added security.
And if you're on a workstation at home or work, you can also bypass this security layer by setting up trusted devices to automatically log in so that you don't need to verify your identity every time.
