8.5.1 MFA systems are implemented as follows: • The MFA system is not susceptible to replay attacks. • MFA systems cannot be bypassed by any users, including administrative users unless specifically documented, and authorized by
MFA systems are implemented as follows: • The MFA system is not susceptible to replay attacks. • MFA systems cannot be bypassed by any users, including administrative users unless specifically documented, and authorized .
system holds itEvidence a system already holds
- Configuration of the multi-factor implementation showing bypass is not possible for any user, including administrators · Identity provider / directory
- Evidence access is granted only after all factors succeed, with logs showing failed factor attempts denying access · Identity provider / directory
periodic reviewEvidence produced at each review
- Evidence at least two different factor types are used, drawn from different categories · Identity provider / directory
governing documentDocuments that govern the control
- Vendor system documentation evidencing the multi-factor system is not susceptible to replay attacks · Policy repository / GRC workspace
- Documented and management authorised exceptions where bypass is permitted, limited in time and scope · Policy repository / GRC workspace
First move
Common gaps auditors find
- Standing administrative bypass retained for support convenience, with no time limit or documented authorisation
- Two factors drawn from the same category, such as a password and a security question, which does not satisfy different types
- Fallback to a single factor when the second is unavailable, granting access before all factors succeed
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet8.4.3 MFA is implemented for all remote access originating from outside the entity's network that could access or impact the CDE · 8.6.1 If accounts used by systems or applications can be used for interactive login, they are managed as follows: • Interactive use is prevented unless needed for an exceptional circumstance. • Interactive use is limited