Do you enforce multi-factor authentication?
A access question from almost every security questionnaire. Here is a model answer, the evidence a reviewer may ask for, and what to say if you don't do this yet.
A model answer
Yes. Multi-factor authentication is enforced for every staff account with access to systems that hold customer data, including [our identity provider, cloud console, source control and production databases]. It is enforced centrally through [identity provider], so it can't be switched off per user.
Replace the parts in square brackets with what's true for you, and only answer yes to what you do.
Evidence a reviewer may ask for
- A screenshot of the MFA enforcement setting in your identity provider
- A list of the systems covered, and how accounts outside SSO are handled
If you don't do this yet
Say where it is enforced today and where it isn't, with a date for the rest. "Enforced on our cloud console and source control; being rolled out to [system] by [month]" is a better answer than a bare yes.
Related questions
Do you review user access regularly?A model answer, the evidence behind it, and what to say if you don't do it yet.Is customer data encrypted in transit and at rest?A model answer, the evidence behind it, and what to say if you don't do it yet.Security questionnaires without SOC 2How to answer a customer's questionnaire honestly before you have an audit.
Answer it once, on your trust center, for every reviewer.
From £39 a month. No sales call.