Does a partial MFA rollout count for insurers and auditors?

Usually not as MFA in place, and an imprecise answer on a form can cause trouble later. Insurance questionnaires and auditors typically ask where MFA is enforced: e-mail, remote access, cloud applications, administrator accounts and backups. If MFA covers e-mail but not the VPN, or users but not administrators, say so exactly, because a claim investigation will check. Close the gaps attackers use most first: remote access, e-mail, admin accounts and the backup console, then the remaining cloud applications. Remove exceptions that are no longer needed, and document the ones you keep with a reason and an end date. Service accounts that cannot use MFA should be restricted to known sources and watched instead. NetSenX does not check MFA coverage; your identity provider reports it. What NetSenX adds to the evidence is network-side: an alert history with timestamps for monitored segments, kept for your plan's retention period.

← All 45 questions on Zero trust, identity and segmentationAll topics