Common small-business pattern: phishing-resistant MFA for privileged roles, authenticator apps for standard users, legacy auth disabled tenant-wide.
Where do you draw the line when two appliances cannot federate and sit behind an MFA jump host? Compensating control, POA&M, or fail?
I want the exception named, the compensating path testable, and the appliance account treated as residual risk — not buried in a footnote. Jump-host MFA does not make the appliance multi-factor.
This post was removed. The reply structure is kept so the thread still reads correctly.
This post was removed. The reply structure is kept so the thread still reads correctly.
This post was removed. The reply structure is kept so the thread still reads correctly.
Sign in to reply.