Has your organization implemented multifactor authentication (MFA) for all user access to systems containing sensitive data?

Multifactor authentication requires users to provide two or more verification factors to gain access to a resource, significantly reducing the risk of unauthorized access even if passwords are compromised. Common MFA implementations include combinations of something you know (password), something you have (security token or mobile app), and something you are (biometric verification). Evidence of MFA implementation could include screenshots of MFA configuration settings in your identity management system, a documented MFA policy, user enrollment statistics showing percentage of accounts with MFA enabled, or system logs demonstrating successful MFA challenges.