MFA and security training: the evidence buyers and auditors ask for

NIST published the final SP 800-63B-4, its authentication and authenticator management guideline, on 31 July 2025. It sets requirements for three authenticator assurance levels and puts phishing resistance at the center of the stronger ones. In June 2024 PCI DSS v4.0.1 had already added a similar idea: non-administrative accounts that authenticate only with phishing-resistant factors are exempt from the MFA requirement for access into the cardholder data environment.

Those are the two controls almost every questionnaire asks about: MFA and staff security training. Here is what to show.

What's affected

Any team answering "do you enforce MFA?" or "do you train staff?" in a SOC 2 audit, an ISO 27001 audit, a PCI assessment or a customer questionnaire. A policy alone does not answer either one.

What to do now

For MFA, keep:

1. An export of the identity provider policy showing MFA is required, dated.
2. A user list showing enrollment status for every account, with exceptions explained.
3. Evidence for admin consoles that sit outside single sign-on, such as cloud root accounts and source control.
4. A record of how you grant and remove access, plus a quarterly access review.

For training, keep:

1. The curriculum and its date.
2. A completion report with names, dates and scores, including new hires within the period your policy states.
3. Evidence of phishing and social engineering content. PCI DSS 12.6.3.1 covers that topic specifically.
4. A follow-up record for people who did not finish.

How to avoid this trap

• Do not count SMS as your strongest option if a buyer asks for phishing-resistant MFA. Passkeys or hardware keys are the usual answer.
• Do not leave break-glass accounts without MFA or monitoring.
• Do not collect completion data once a year. Auditors sample, so every month needs something.
• Do not accept "attended" as proof of learning. A short quiz is better evidence.

Try it yourself

Pick five people at random and produce, within ten minutes, their MFA enrollment and training completion records. If you cannot, build the report first.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• NIST CSRC: SP 800-63B-4 (final, 31 July 2025)
• PCI SSC blog: Just published, PCI DSS v4.0.1