Answer for the devices, accounts and services covered by this assessment, including remote work and applicable personal devices. “Yes” means every applicable check in the description is in place. Choose “Not sure” when evidence is missing; use “Not applicable” only when its stated reason is true. This questionnaire does not inspect your systems.

Question 1 of 140% Complete

Account authentication

Is MFA enforced for all accounts where available, including cloud users and administrators?

Check actual sign-in policies, not just MFA registration. Prefer phishing-resistant methods for sensitive accounts; MFA does not prevent every phishing attack.