Example finding • High priority
Multi-factor authentication is missing from administrator accounts.
- Observation
- In this fictional scenario, the administrator account can sign in using a password alone. No additional verification method is required.
- Why it matters
- A stolen password could allow an attacker to change settings, access business information or take control of other accounts.
- Recommended action
- Require MFA for administrator accounts, prefer phishing-resistant methods where supported, and separate everyday work from administrator access. Plan recovery access before making changes.
- Suggested owner and priority
- The person responsible for business IT should address this promptly, with a completion date agreed with management.
- How to verify the improvement
- Review the MFA policy and complete an authorised sign-in check. Confirm that the recovery procedure is documented and stored securely.