Security questionnaire answers › Access control
Do you require multi-factor authentication? How to answer it in a security questionnaire
Why buyers ask this
Stolen passwords are a leading cause of breaches, and MFA is the cheapest strong control against that.
What a strong answer includes
- Say where MFA is enforced: workforce SSO, production, source control, cloud console, and customer admins.
- State whether MFA is enforced by policy or only available.
- Prefer phishing-resistant methods (security keys, passkeys) where you can, and say so.
Sample answer to adapt
Replace the bracketed parts with your own facts. Only state what is true for your environment.
Yes. MFA is enforced for all workforce accounts through [IdP], and for access to production, the cloud console and source control. Customer accounts support [TOTP/SSO MFA], and administrators [are required to/can] enable it.
Evidence to attach
- IdP MFA enforcement setting
- Cloud account MFA report
- Access control policy
Common mistakes
- Saying yes when it is optional for staff.
- Forgetting shared or service accounts.
Answer questionnaires from your own documents
Korrali Trust drafts answers from your policies and evidence so every response traces back to its source, and a person reviews it before it goes out.