Control · MFA-004
Multi-Factor Authentication for Privileged Access
Assessment of whether all privileged access paths are protected by phishing-resistant multi-factor authentication.
HIGHPartially Effective
- Framework
- Australian ISM · 1173
- Domain
- Identity & Access
- Conclusion
- Partially Effective
- AI Confidence
- 89%
- Affected Accounts
- 2 emergency admins
- Last Assessed
- Today 11:03
AI-Proposed ReasoningFor assessor confirmation
PreviewMFA is enforced for 98% of privileged sign-ins via Conditional Access. Two emergency (break-glass) administrator accounts are excluded by policy. The proposed conclusion is Partially Effective: the exclusion is a recognised pattern but lacks compensating monitoring evidence.
Supporting Evidence
PreviewEvidence considered in reaching this conclusion.
ReferenceEvidenceSourceAge
EVD-092Conditional Access policy exportEntra ID3 days
EVD-087Privileged access reviewEntra ID87 days
EVD-118Break-glass account inventoryEntra ID5 days
Counter-Evidence & Open Questions
PreviewFlagged for the assessor to weigh before confirming.
- No alerting evidence for break-glass account usage
- Privileged access review evidence approaching 90-day expiry
- Compensating control (PIM activation) not yet linked
Demo workspace — detailed workflow coming next