The Complete Guide to MFA Enforcement

Multi-factor authentication (MFA) is the single most impactful security control you can implement. 96% of cyber insurance carriers now require enforced MFA as a condition of coverage. The keyword is "enforced" — having MFA available but optional is not sufficient. MFA prevents over 99% of account compromise attacks. Without it, a single phished password gives attackers full access to your systems, email, and client data. With MFA enforced, even a compromised password is useless without the second factor. Every major compliance framework requires MFA: the FTC Safeguards Rule, NIST CSF, CIS Controls, SOC 2, NIST 800-171, and the SEC cybersecurity rule.

Implement MFA across all critical systems: 1. Email (Microsoft 365, Google Workspace) — Enforce conditional access policies requiring MFA for all users. 2. VPN and remote access — All remote connections must require MFA. 3. Admin/privileged accounts — MFA required for all administrative access, no exceptions. 4. Cloud applications — Enforce MFA on SaaS applications handling sensitive data. 5. Financial systems — Banking, accounting, and payment systems must require MFA. Preferred MFA methods (strongest to weakest): - FIDO2/WebAuthn hardware keys (YubiKey) - Authenticator apps (Microsoft Authenticator, Google Authenticator) - Push notifications - SMS codes (acceptable but not preferred)

Avoid these pitfalls: 1. Enabling but not enforcing — MFA must be required, not optional. Carrier scans check for enforcement. 2. Exempting executives — Executives are the highest-value targets. No exemptions. 3. SMS-only MFA — While better than nothing, SMS is vulnerable to SIM swapping. Use authenticator apps or hardware keys. 4. No backup methods — Ensure users have backup MFA methods (recovery codes, backup phone) to avoid lockouts. 5. Not covering admin accounts — Admin accounts without MFA are the biggest risk. Enforce MFA on all privileged access.