Split the answer into three parts: staff access to your systems, privileged and admin access, and what your product offers customers. For each, name the method and say whether it is enforced or optional. CISA treats phishing-resistant MFA (FIDO/WebAuthn) as the standard to aim for, and any MFA as better than none.
The three audiences
A single "yes, we use MFA" hides the details a reviewer wants.
- Staff. Is MFA enforced on your identity provider for every employee and contractor, including on email and source control?
- Privileged access. Do cloud consoles, production databases and admin tools require MFA, ideally a stronger method?
- Customers. Can customers turn on MFA for their users, and can an admin require it?
What CISA says about methods
CISA's MFA guidance describes common forms: SMS or voice, app based, phishing-resistant, and biometrics. It says phishing-resistant MFA is the standard organizations should aim for, and that the only widely available option is FIDO/WebAuthn, which blocks sign in to fake sites. If that is not possible yet, it advises number matching to counter push bombardment. It also states that any MFA is better than none.
For priority accounts, CISA lists email, financial services and, for organizations, remote access, email and billing systems.
Answer patterns
| Your state | Wording |
|---|---|
| Authenticator app enforced for all staff | MFA is enforced for all staff through our identity provider using authenticator apps with number matching |
| Hardware keys for admins | Administrators and production access use FIDO2 security keys |
| SMS for some users | Some accounts still use SMS codes. We are moving them to app based or FIDO methods |
| Customer MFA optional | Customers can enable MFA, and admins can require it for their tenant |
Be exact about "enforced" versus "available". Reviewers read "available" as "not enforced".
Common gaps to close before you answer
- Shared accounts for admin tools with no individual MFA.
- Contractors outside the identity provider.
- Service accounts and API keys, which have no MFA. Describe how you scope and rotate them.
- Break glass accounts. Say how they are stored and monitored.
- Recovery flows that bypass MFA through email alone.
Evidence to attach
- A screenshot of the identity provider policy requiring MFA, dated.
- A report of users with and without MFA enrolled.
- The list of privileged roles.
- A short description of how a lost device is handled.
Quick check
Is SMS MFA acceptable to claim?
It counts as MFA, and CISA says any MFA beats none, but stronger methods are preferred. Name the method honestly and state your plan to move off SMS if you have one.
What is phishing-resistant MFA?
CISA describes it as FIDO/WebAuthn, which prevents sign in to fake sites. It is the standard CISA says to aim for.
Safeguard's agent identity and policy features help scope non-human credentials, and its compliance evidence automation can collect settings for your records. You can also run the free scan on a repository.
Sources
- CISA, MFA guidance (archived page). Paraphrased.
Last reviewed: 19 October 2026.
