Passwords leak — through phishing, reuse, and breach dumps — and a second factor turns a stolen credential into a dead end, which is why MFA appears in every serious control set. SOC 2 auditors look for it on infrastructure and email; ISO 27001 treats it as baseline access control; HIPAA reviewers expect it around patient data; cyber-insurance applications now gate coverage on it; and nearly every enterprise security questionnaire asks about it on the first page. It is the closest thing compliance has to a universal expectation.
Most failed MFA controls fail at the edges, not the center. Employees enrolled in the identity provider are usually fine; the gaps auditors find live elsewhere — break-glass admin accounts, service accounts and API keys that cannot take a second factor and have no compensating control documented, legacy protocols that sidestep modern authentication, contractors outside the directory, and SaaS bought on a credit card that never joined single sign-on. Enrollment is not enforcement, either: a factor that is registered but optional protects nothing.
The evidence is a policy export from the identity provider showing MFA required, plus a coverage report reconciling every in-scope account against it — including the awkward ones above. Stronger programs reserve phishing-resistant factors like hardware keys for administrators, and pair the control with least privilege so a bypassed factor still lands on a small blast radius. How access controls get written, enforced, and evidenced as one system is the territory of Policy and Access.
