What evidence actually proves MFA is enforced?
A configuration screenshot alone will not survive a competent assessor. What holds up is a set: the policy that requires MFA, the enforcement configuration showing it applies to all in-scope users rather than being merely available, a population-versus-sample check demonstrating no unenforced accounts, and the documented handling of any exceptions. The screenshot proves the setting exists; the population check proves it bites.
The failure mode assessors look for is the gap between 'MFA is enabled' and 'MFA is enforced for everyone in scope'. Service accounts, break-glass accounts, contractors and legacy protocol paths are where that gap usually lives.
If you have exceptions, document them with a compensating control and a review date. An acknowledged, controlled exception is a far better finding than an undiscovered one.
Sources
- NIST SP 800-171A — assessment objectives for identification and authentication
- AICPA Trust Services Criteria — logical access
Drafted with the tools on this site, then checked against the sources above by a practitioner before publishing. Reviewed 2026-08-07. Found something wrong? It should be corrected — this page is only worth as much as its accuracy.