# Does a partial MFA rollout count for insurers and auditors?

Usually not as MFA in place, and an imprecise answer on a form can cause trouble later. Insurance questionnaires and auditors typically ask where MFA is enforced: e-mail, remote access, cloud applications, administrator accounts and backups. If MFA covers e-mail but not the VPN, or users but not administrators, say so exactly, because a claim investigation will check. Close the gaps attackers use most first: remote access, e-mail, admin accounts and the backup console, then the remaining cloud applications. Remove exceptions that are no longer needed, and document the ones you keep with a reason and an end date. Service accounts that cannot use MFA should be restricted to known sources and watched instead. NetSenX does not check MFA coverage; your identity provider reports it. What NetSenX adds to the evidence is network-side: an alert history with timestamps for monitored segments, kept for your plan's retention period.

FAQ: [Zero trust, identity and segmentation](https://netsenx.com/en/faq/zero-trust) · https://netsenx.com/en/faq/does-a-partial-mfa-rollout-count

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/pricing

## Related questions

- [Which MFA methods resist phishing?](https://netsenx.com/en/faq/which-mfa-methods-resist-phishing)
- [What is MFA fatigue, or push bombing?](https://netsenx.com/en/faq/what-is-mfa-fatigue-or-push-bombing)
- [Who holds admin rights in our company, and how do we check?](https://netsenx.com/en/faq/how-to-find-out-who-has-admin-rights)
- [What does least privilege mean in practice?](https://netsenx.com/en/faq/what-is-least-privilege-in-practice)
- [Do service accounts and API tokens need monitoring too?](https://netsenx.com/en/faq/do-service-accounts-and-api-tokens-need-monitoring)