MFA enforcement gap on privileged admin accounts

CTRL-IAM-047/APRA CPS 234 Information Security, ISO 27001 Annex A.5.17 and A.8.2.

Control statement

All privileged identities with access to production workloads, customer data, or security administration functions must be protected by phishing-resistant multi-factor authentication and reviewed for policy compliance at least weekly.

What the evidence shows

The IAM policy export shows three accounts assigned to the privileged administrator group with the MFA required flag set to false. Access logs confirm all three accounts authenticated to production consoles during March 2026 using password-only sessions, including one session originating from an unmanaged device.

Evidence artefacts

iam-policy-export-2026-03-28.json
privileged-access-review-q1-2026.xlsx
admin-console-logins-mar-2026.csv

Affected assets

3 privileged administrator accounts

PressRto run·1–5for stages

Remediation Memory

2 similar past remediations found

94%Similarity
CTRL-IAM-032·closed on 14 Feb 2026
Phishing-resistant MFA enforcement on privileged accounts
Removed MFA exemption flags from the privileged administrator group, enforced phishing-resistant factors, and enabled continuous weekly compliance sweeps on the identity provider.
- Same control domain: Identity & Access
- Same severity: Critical
- Control ID family: CTRL-IAM-
- Keyword overlap: mfa, privileged, admin, administrator, phishing, identity, authentication
22 min · closed by Priya4 reusable artefacts
51%Similarity
CTRL-IAM-041·closed on 03 Nov 2025
Stale service account deactivation and credential rotation
Identified service accounts with no authentication activity in 90 days, disabled the accounts, rotated remaining credentials, and added a recurring reconciliation job between HRIS, CMDB, and the identity provider.
- Same control domain: Identity & Access
- Control ID family: CTRL-IAM-
- Keyword overlap: identity
64 min · closed by Marcus3 reusable artefacts

Agent workspace

Click "Run remediation agent" to begin. The agent will diagnose the gap, plan the remediation, and ship the work in real time.