MFA coverage gaps can hide in places a simple “MFA enabled” report does not show. A user may have MFA enrolled for webmail but still reach the same mailbox through an app, or a remote-access tool may allow connections without the same checks. Administrative, vendor, emergency, and service accounts can also be missed.
The practical way to find gaps is to make an inventory of accounts and systems, verify that MFA is enforced on the ways people actually sign in, and record exceptions until they are resolved or formally accepted. This also gives your business clearer evidence to review against its cyber insurance application. Insurer requirements vary, so check the wording of your own application and policy rather than assuming one checklist fits every business.
Start with an account and system inventory
Build a working register that covers more than employee accounts. Include the systems that provide access to business email, files, networks, devices, backups, and administrative settings. Consider:
- Email and productivity: Mailboxes, collaboration tools, and accounts used to access email through desktop or mobile apps.
- Remote access: VPNs, remote desktop access, remote support tools, and other ways staff or vendors connect from outside the office.
- Administrator access: Cloud consoles, servers, network equipment, security tools, and other systems where users can change settings or grant access.
- Backup and recovery: Backup consoles, recovery platforms, and accounts that can restore or delete protected data.
- Other identities: Local administrator accounts, vendor accounts, emergency accounts, and service accounts used by software or devices.
For each entry, record the system or account, its business owner, who can access it, whether MFA is supported, whether it is enforced, the enforcement method, any exception, and the date it was last reviewed. If several accounts use one platform, make the scope clear so a reviewer can tell what the record includes.
Check enforcement, not just enrollment
A person enrolled in an authenticator is not proof that every sign-in path requires MFA. Review the controls that govern access and test the common ways users connect. The goal is to establish that MFA is required where intended, not merely offered as an optional setting.
Email accounts and connected apps
For MFA for email accounts, check both webmail and email access through approved apps. Review the identity or access policies that apply to each sign-in route, including whether older or alternate authentication methods remain available. Confirm that staff, administrators, and other accounts with mailbox access are within the intended scope.
Also look for accounts that were excluded from a policy or assigned a special sign-in rule. Record why the exclusion exists and who approved it. CISA’s guidance on requiring multifactor authentication can help inform your review of MFA implementation.
VPN, remote desktop, and support tools
For MFA for VPN and remote access, inspect each route that can connect to business systems remotely. That can include VPN access, remote desktop gateways, remote-support software, and vendor access. Confirm which identities can use each route and whether MFA is required before the connection is granted.
Do not assume one remote-access setting protects a separate tool. When a vendor or platform manages the configuration, ask for evidence of the relevant setting and confirm the scope. Test access in a controlled way so you can verify the sign-in experience without disrupting work.
Administrator and less-visible accounts
For MFA for administrator accounts, identify the accounts that can change security settings, manage users, access sensitive data, or control backups. Include local and cloud-based administrator identities where they apply. Review vendor and emergency accounts with the same care, even if they are rarely used.
Service accounts may not be able to complete an interactive MFA prompt. Do not silently exclude them. Confirm what the account does, whether it still needs access, and what safeguards are available. CISA’s administrator identity and access management recommendations offer additional considerations for reviewing privileged access.
Make exceptions visible and manageable
When MFA is unsupported, temporarily unavailable, or incompatible with a particular account, document it as an exception instead of counting it as covered. A useful exception record states:
- The affected account, system, and access route.
- Why MFA is not currently enforced and what business function depends on the access.
- Any compensating controls in place, such as restricting access, limiting permissions, or monitoring use.
- Who accepted the risk, who owns the remediation, and the target for resolving it.
- What evidence will show that the exception has been closed.
Keep unsupported, excepted, not applicable, and MFA-enforced items separate in reports. A single coverage percentage can hide important exclusions unless its scope and calculation are clearly explained. If a vendor system does not support MFA, ask whether there is a supported configuration or safer access method, reduce exposure where practical, and track the issue for follow-up. If an account no longer serves a business need, consider whether it should be removed rather than treated as a permanent exception.
Keep evidence that shows scope and enforcement
For cyber insurance MFA evidence, retain dated configuration or policy exports, account enrollment or coverage reports, and a copy of your inventory. Add exception approvals and remediation records so the evidence shows what was excluded and what changed. Configuration evidence shows how a system is set up; enrollment information helps show which users or accounts have completed setup. Neither alone necessarily proves that all sign-in paths require MFA.
Keep records in an access-controlled location and avoid placing secrets or sensitive authentication details in a general-purpose checklist. Compare the evidence with the actual questions on your insurer’s application. The cyber insurance application example illustrates why it is useful to review the specific wording and scope requested, rather than relying on a generic statement that MFA is in use.
For related preparation, see this guide to organizing evidence for a cyber insurance renewal. Keep the inventory and supporting records current, and review them after changes to staff access, systems, vendors, or authentication policies, as well as during insurance preparation.
Frequently asked questions
How can a business check whether MFA is enabled for every account?
Use the inventory to identify accounts across each system, then compare it with each system’s policy and enrollment reports. Investigate any account that is missing, excluded, unsupported, or not clearly covered. Verify the actual sign-in requirements for important access routes.
Does MFA need to cover email accessed through apps as well as webmail?
Include both in the review. Check which authentication rules apply to webmail and the approved apps employees use, and look for alternate sign-in methods or exclusions that could change whether MFA is required.
How often should MFA enrollment and exceptions be reviewed?
Set a recurring review schedule that fits your business, and revisit the inventory when staff, systems, vendors, or access policies change. Keep exceptions assigned to an owner and review their status until they are closed or formally reconsidered.
What should a business do when a system or vendor does not support MFA?
Document the limitation, confirm whether a supported alternative exists, and apply reasonable access restrictions or other safeguards while the issue remains. Assign an owner to follow up and keep the exception visible in coverage reporting.
Make MFA coverage reviewable
A clear MFA inventory helps your team see what is protected, where exceptions remain, and what evidence supports the picture. For help reviewing access controls, Zevonix provides managed IT and cybersecurity services to businesses across Northeast and Central Florida. Contact Zevonix at (904) 658-0777 to discuss a practical review of your MFA coverage.