Require MFA for Administrative Access
Description
Require MFA for all administrative access accounts, where supported, on all enterprise assets, whether managed on-site or through a third-party provider.
Implementation Checklist
Tool Recommendations
Cloud identity and access management with SSO, MFA, conditional access, and identity governance
Microsoft · Per-user subscription (P1/P2)
Cloud identity platform providing SSO, adaptive MFA, lifecycle management, and API access management
Okta · Per-user subscription
Multi-factor authentication and zero-trust access platform with device trust and adaptive access policies
Cisco · Per-user subscription
Enterprise identity security platform with SSO, MFA, directory, and API security for workforce and customer identity
Ping Identity (Thales) · Per-user subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Admin Credential Compromise Leading to Full Domain Takeover
ConfidentialityAn attacker obtains administrator credentials through phishing, keylogging, or hash theft and gains unrestricted administrative access because no second factor protects privileged accounts.
Privilege Escalation via Stolen Admin Password
IntegrityAn attacker escalates from a standard compromise to full administrative control by using a stolen admin password, since MFA is not required for administrative access to any enterprise systems.
Vulnerabilities (When Safeguard Absent)
No MFA on Administrative Accounts
Administrative accounts protected by passwords alone represent the highest-value, lowest-resistance targets; a single compromised password yields complete system control.
Third-Party Admin Portals Without MFA
Administrative access to cloud services, SaaS platforms, and managed service provider portals lacks MFA, allowing remote administrative takeover with stolen credentials.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Technical | MFA enrollment status and enforcement configuration | Reviewed monthly |
| Record | Third-party risk assessment reports and scorecards | Annually per vendor |
| Document | Vendor contracts with security requirements | Per contract cycle |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |