Multi-factor sign-in and password policy
Accounts need a second factor; weak or reused passwords are refused.
Layer L4 Infrastructure / target · Owner Organisation hit · Family The target's own defences
–Held
–Failed
–Got around
–Missing
By risk
| Risk | Held | Failed | Got around | Missing | Not mentioned |
|---|---|---|---|---|---|
| Credential and privilege abuse | – | – | – | – | – |
| AI used to run a cyber attack | – | – | – | – | 2 |
Why it did not hold
No incident yet records this control not holding.
By quarter
| Period | Held | Failed | Got around | Missing |
|---|---|---|---|---|
| 2025-Q3 | – | – | – | – |
| 2025-Q4 | – | – | – | – |
| 2026-Q1 | – | – | – | – |
| 2026-Q2 | – | – | – | – |
| 2026-Q3 | – | – | – | – |
| 2026-Q4 | – | – | – | – |
Added in reported fixes, and what followed
No reported fix names this control yet.
Frameworks
| Framework | Item | Text |
|---|---|---|
| NIST SP 800-53 | IA-2(1) | To verify when the text is stored |
| NIST CSF 2.0 | PR.AA-03 | To verify when the text is stored |