SFS 3 / SF 0

Back to SFS 3

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Are multi-factor authentication mechanisms enforced for all user access to critical services throughout the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Multi-factor authentication is consistently required and validated for access

Assessment criterion and evidence

Actor: organization's identity management system. Scope: standard user accounts accessing critical services. Evidence period: review period. Required evidence: Documented authentication policy specifying MFA requirements; Technical evidence of MFA enforcement configuration; Audit logs demonstrating MFA usage patterns. Negative criterion: Single-factor authentication is permitted for critical service access. Missing evidence: Pending verification of authentication configuration records

View the JSON record (opens in a new tab).

Assessment result: unset.