What to answer when the questionnaire asks 'is MFA enforced for all users?'

MFA questions appear in almost every vendor questionnaire, in many wordings. The same few controls sit behind all of them. If you know the controls, you can answer every variant the same way.

The variants

• Is multi-factor authentication enforced for all users?
• Is MFA required for remote and administrative access?
• Is MFA enforced on your email system?
• Is MFA enforced on your source code repositories?

What the client wants to know

They want to know that a stolen password is not enough to reach their data. They do not expect a small vendor to run a hardware token programme. They expect you to name the systems and be accurate.

An answer when MFA is everywhere

Name the systems: email, code hosting, cloud consoles and admin panels. Say that authenticator apps or security keys are used where the service supports them. One sentence is enough.

An answer when MFA is not everywhere yet

Do not answer yes. Say which systems have it, say enabling it on all accounts is the first priority, and give a date. A statement like "not on every system yet, this is our first priority, planned by 31 December 2026" is one a client can accept and later check.

The fix itself

Turn on MFA for every account in email, code hosting, cloud consoles and admin panels. Use an authenticator app or a security key rather than SMS where possible. For a small team this is usually an hour of settings.

Related questions that go with it

MFA questions usually come next to password and account questions: how passwords are stored, whether shared accounts exist, and whether you use single sign-on. A company password manager answers the first two. If you have one identity provider for your main apps, access is granted and removed in one place, which answers the third. Our guide on access control questions lists all 11 related questions in the kit and what a good answer contains.

To see where your own gaps are, the free Security Overview builder marks each missing control and gives the fix step.

---

Disclosure: this account is published by Security Answer Kit, the maker of the tool linked above (EUR 49 for the full kit, the Security Overview builder is free). This article was written with AI assistance and checked against the kit's own content before it was queued, as dev.to's guidelines for AI-assisted articles ask (https://dev.to/guidelines-for-ai-assisted-articles-on-dev).