The Exceptions That Break MFA Start in the Boardroom
Executive MFA carve-outs are the weakest link in enterprise identity programmes—the piece argues that governance failures at board level, not technology gaps, drive most exemption sprawl.
Summary written by editorial AI · Source link below
The uncomfortable truth about MFA is that its implementation can start running into trouble before the technical rollout is even finished. IT switches it on, and then a senior calls to ask whether they can be excluded. Perhaps they fear that the extra authentication step will slow them down. The request sounds minor. Grant it, […] The post The Exceptions That Break MFA Start in the Boardroom appeared first on IT Security Guru .
Editorial Analysis
Under NIS2, management bodies bear personal liability for inadequate security measures; unchecked MFA exceptions create both a technical vulnerability and a compliance exposure.
Audit all active MFA exceptions, require CISO sign-off with documented compensating controls, and report exception metrics to the board quarterly.
Board-granted MFA exceptions undermine the very controls NIS2 holds management personally accountable for—formalise the exception process now.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at IT Security Guru in a new tab.
More from the Security Desk
- Iris Ohyama data cloud breach exposes info of 7.7 million customers1d
- After Binance, check what your signing systems can approve3d
- DigiCert data breach exposes customer information, identity documents4d
- Why waiting for quantum computers to arrive could leave your security exposed4d
- DreamHost confirms data breach exposed FTP logins and webmail sessions5d