The service may be configured to require a second authentication factor when a user signs in, and can require that MFA was used as a condition on sensitive actions.
Multi-Factor Authentication
CCC.IAM.CP14
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.IAM.TH13 | Multi-Factor Authentication is Not Enforced | MFA enforcement may be left unconfigured or disabled for an identity, or a sign-in may be allowed to complete with a single factor. A password or token obtained through phishing, leakage or brute force is then sufficient to authenticate as that identity. This results in a loss of confidentiality of the resources the identity can read and of integrity where it can write. |