SOC2-CC6-MFA
Multi-Factor Authentication (MFA)
What this control does
Requirement for a second authentication factor for all access to production systems, cloud consoles, VPNs, and identity providers.
Implementation guidance
Enforce MFA via your SSO/IdP (Okta, Google Workspace, Azure AD) for all human accounts. Require TOTP or hardware key; SMS is acceptable only as fallback. Service accounts should use IP allowlisting and API keys instead of MFA. Review exceptions quarterly.
Requirements satisfied
Why it matters
Compromised credentials remain the leading attack vector for unauthorized system access; MFA eliminates the risk of single-factor credential theft being sufficient to breach production systems. Without MFA, attackers who obtain passwords via phishing, data breaches, or social engineering gain immediate access to critical infrastructure, cloud consoles, and sensitive data—often without detection until significant damage occurs.
Evidence to collect
- Okta/Azure AD/Google Workspace policy report showing MFA enforcement per application and user group
- Screenshot of MFA enrollment flow with TOTP or hardware key configured for a test account
- Documented exceptions log listing accounts exempt from MFA with quarterly review sign-offs
- VPN and production bastion host access logs confirming MFA prompts for non-service-account access
Testing procedure
Request IdP policy reports and verify MFA is enforced for all human user roles accessing production systems, cloud consoles, and VPNs via conditional access rules or explicit group policy. Attempt to authenticate to each system with a valid credential but without completing MFA to confirm authentication fails. Query recent access logs (past 30 days) for any MFA bypass events or exempted accounts and validate all exceptions are documented with business justification and current approval.
Common gotchas
Teams often exempt service accounts and automation from MFA, then accidentally apply MFA to those accounts anyway, breaking deployments—enforce MFA for humans only and use IP allowlisting + API key rotation for service accounts instead. SMS is frequently set as the primary MFA method due to ease of deployment, but is vulnerable to SIM-swap attacks; audit your IdP settings to ensure TOTP or hardware keys are the default and SMS is restricted to recovery/fallback scenarios only.