MFA Enforcement: A Practical Guide to Blocking Account Takeovers

Your business may already have multifactor authentication (MFA), but that does not necessarily mean every important sign in is protected. Passwords remain one of the most common ways attackers gain unauthorized access to business systems, and gaps in MFA coverage can leave users, applications, or access paths exposed.

Understanding where those gaps exist and how to strengthen your authentication strategy is essential for reducing the risk of account compromise.

This guide explains how MFA enforcement works, the authentication methods that provide the strongest protection, common implementation mistakes to avoid, and practical steps to strengthen your organization's identity security.

What Is MFA Enforcement?

Most people think enabling multifactor authentication (MFA) is enough to protect business accounts. In reality, simply offering or enabling MFA does not guarantee users will be required to complete a second verification step every time they sign in.

Multifactor authentication works by requiring users to verify their identity using two or more factors. These factors typically include something they know, such as a password, something they have, such as a mobile device or security key, or something they are, such as a fingerprint or facial recognition.

MFA enforcement is the policy that makes this protection mandatory. Instead of allowing users or applications to decide when MFA is used, enforcement requires approved authentication methods whenever predefined conditions are met. Those conditions may apply to specific users, applications, devices, locations, or levels of risk.

Understanding the difference between common MFA terms helps explain why enforcement is so important:

MFA Status	What It Means
MFA available	The application or service supports multifactor authentication.
MFA registered	The user has enrolled one or more authentication methods.
MFA enabled	MFA has been turned on for the account or environment.
MFA enforced	A policy requires users to complete MFA under defined sign in conditions.
Phishing resistant MFA enforced	The policy requires authentication methods, such as passkeys or security keys, that are designed to resist credential phishing.

Even when MFA appears to be enabled, it is important to verify that the enforcement policy covers every intended user and application. Microsoft warns that detecting an enabled Conditional Access policy does not necessarily mean every intended user will be required to complete MFA. Administrators must review the users, applications, conditions, and exclusions within the policy.

Why Centralized MFA Enforcement Matters

An MFA strategy is only effective if it is applied consistently across the organization. When employees are responsible for enabling or managing their own MFA settings, security gaps can quickly appear. Some users may delay enrollment, choose less secure authentication methods, or accidentally bypass recommended security practices.

Centralized MFA enforcement gives your organization the ability to define and apply authentication policies from a single location. Rather than relying on individual users, administrators can ensure security requirements are enforced consistently across users, applications, devices, and sign in scenarios.

With centralized enforcement, organizations can control:

• Which users and groups must use MFA
• Which applications and systems require MFA
• Which authentication methods are permitted
• When additional verification is required based on risk, device, or location
• Which accounts or services are excluded from standard policies
• How factor resets and account recovery requests are approved
• How MFA policies are monitored and reviewed for ongoing effectiveness

There is also an important distinction between MFA adoption and MFA enforcement. MFA adoption measures how many users have registered a second authentication factor. MFA enforcement determines whether users are actually required to complete MFA when accessing business systems. A high registration rate provides little protection if users can still sign in without a second verification step under certain conditions.

Does MFA Really Stop 80% of Cyberattacks?

MFA is one of the most effective ways to reduce the risk of unauthorized account access, but it delivers the best protection when it is properly enforced and supported by other security controls.

The widely cited 80% figure comes from Microsoft research showing that organizations using Security Defaults experienced significantly fewer account compromises than those that did not.

Security Defaults include MFA enforcement alongside other built in protections, such as blocking legacy authentication and applying secure identity policies. As a result, the reduction in compromises cannot be attributed to MFA alone.

Microsoft has also reported that MFA can prevent more than 99% of automated account compromise attempts that rely on stolen or guessed passwords. This demonstrates how effective MFA is at stopping identity based attacks, including credential stuffing, password spraying, and many phishing attempts.

However, MFA is not a complete cybersecurity strategy. It does not prevent malware infections, software vulnerabilities, insider threats, or every type of phishing attack. Attackers continue to evolve their techniques, which is why businesses should combine MFA with endpoint protection, regular patching, email security, continuous monitoring, and strong access controls.

Which Cyberattacks Does MFA Help Prevent?

While MFA is one of the most effective defenses against identity-based attacks, its effectiveness depends on how it is implemented. Strong authentication methods, consistent enforcement policies, and regular reviews all play an important role in reducing the risk of unauthorized access.

Attackers use a variety of techniques to steal or abuse user credentials. While MFA cannot stop every type of cyberattack, it can significantly reduce the success rate of many common account compromise methods.

Password Spraying

Password spraying is a technique where attackers try a small number of commonly used passwords across many user accounts. Even if they guess a valid password, MFA requires a second verification step before the attacker can sign in.

Credential Stuffing

Credential stuffing uses usernames and passwords stolen from previous data breaches. Because many people reuse passwords across multiple accounts, attackers can often gain access with little effort. MFA reduces this risk by ensuring that stolen credentials alone are not enough to authenticate.

Password Reuse Attacks

Employees sometimes use the same or similar passwords for both personal and business accounts. If one of those passwords is exposed in an unrelated breach, attackers may attempt to use it to access company systems. MFA provides an additional layer of protection, even when a password has been compromised.

Stolen Credentials Through Phishing

Phishing emails, fake login pages, and information-stealing malware are designed to capture usernames and passwords. While MFA cannot prevent someone from entering their password into a fraudulent website, it can stop many attackers from successfully using those stolen credentials without the required second authentication factor.

Unauthorized Remote Access

Remote access services, VPNs, cloud infrastructure, and administrator portals are common targets because they provide direct access to business systems. Requiring MFA for these services significantly reduces the risk of unauthorized access and is recommended by organizations such as the Cybersecurity and Infrastructure Security Agency (CISA).

Account Takeover Attempts

Any account protected only by a password presents a single point of failure. MFA adds another security barrier that attackers must overcome, making account takeover considerably more difficult. Instead of relying on a stolen password alone, attackers must also compromise a trusted device, intercept an authentication request, or exploit another weakness.

What MFA Cannot Prevent on Its Own

While MFA significantly reduces the risk of unauthorized access through stolen or compromised credentials, it cannot stop every type of attack. Cybercriminals continue to target software vulnerabilities, trusted user sessions, third party connections, and other weaknesses that exist beyond the sign in process.

Threat	Why MFA Alone Is Not Enough
Unpatched Software Vulnerabilities	Attackers can exploit security flaws in applications or operating systems without needing to authenticate with a user account.
Malware on an Authenticated Device	Once a user has successfully signed in, malware running on the device may continue operating with that user's access.
Session Token Theft	If an attacker steals a valid session token, they may access the account without triggering another MFA prompt.
Malicious OAuth Consent	A user may unknowingly grant a malicious application permission to access business data, even after completing MFA.
Insider Threats	MFA verifies a user's identity but cannot prevent an authorized employee from intentionally or accidentally misusing their access.
Weak Account Recovery Processes	Attackers may bypass MFA by exploiting insecure password resets or authentication recovery procedures.
Adversary in the Middle (AiTM) Attacks	Sophisticated phishing attacks can capture authentication sessions and bypass traditional MFA methods in certain scenarios.
Compromised Third Party Access	Vendors or external partners with trusted access may introduce risk if their own accounts or systems are compromised.

Traditional MFA methods, such as one time passcodes and push notifications, provide significantly stronger protection than passwords alone.

However, they can still be targeted through phishing, social engineering, MFA fatigue attacks, and adversary in the middle techniques. For higher risk accounts, organizations should consider phishing resistant authentication methods, such as passkeys or hardware security keys, wherever possible.

Which MFA Methods Provide the Strongest Protection?

Enabling MFA is an important first step, but the type of authentication method you choose has a significant impact on your overall security. While every MFA method provides more protection than relying on a password alone, some are far more resistant to modern phishing and account takeover techniques.

Cybersecurity authorities, including the Cybersecurity and Infrastructure Security Agency (CISA), recommend using phishing resistant authentication wherever possible. These methods use cryptographic verification rather than one time codes or push notifications, making them much more difficult for attackers to intercept or misuse.

Authentication Method	Protection Level	Best For	Key Limitation
Passkeys / FIDO2 Security Keys	Very High (Phishing Resistant)	Administrators, privileged users, high security environments	Requires compatible devices and a well planned recovery process
Certificate Based Authentication	Very High (Phishing Resistant)	Enterprise environments with managed devices	More complex to deploy and manage
Windows Hello for Business	Very High (Phishing Resistant)	Windows devices managed through Microsoft environments	Requires compatible hardware and identity configuration
Authenticator App with Number Matching	High	Most business users	Relies on users recognizing and rejecting fraudulent prompts
Time Based One Time Passcodes (TOTP)	Moderate	General user authentication	Codes can still be captured through sophisticated phishing attacks
Standard Push Notifications	Moderate	Organizations beginning MFA adoption	Vulnerable to MFA fatigue and accidental approvals
SMS Verification Codes	Low	Backup authentication where stronger methods are unavailable	Susceptible to SIM swapping, interception, and social engineering
Email Verification Codes	Low	Low risk or temporary verification scenarios	Security depends on the protection of the email account itself

Microsoft recommends phishing resistant authentication methods, such as passkeys, FIDO2 security keys, Windows Hello for Business, and certificate based authentication, because they use cryptographic verification that cannot be easily replayed through fraudulent websites or traditional phishing attacks.

The 5E MFA Enforcement Framework

Implementing MFA is an important first step, but effective protection requires more than simply enabling a security feature. Users change roles, new applications are introduced, exceptions are created, and authentication methods evolve over time. Without regular oversight, gaps can develop that leave parts of your environment exposed.

The following five-step framework provides a practical approach to building, strengthening, and maintaining MFA enforcement across your organization:

1. Enumerate Every Identity and Access Path

You cannot protect what you cannot see. Start by identifying every identity, account, application, and service that can access business systems or data. Your inventory should include:

• Employees
• Executives
• Privileged administrators
• Finance and human resources staff
• Contractors and third-party vendors
• Guest users
• Remote employees
• VPN connections
• Microsoft 365 and other cloud applications
• Backup and security platforms
• Accounting and payment systems
• Emergency access accounts
• Service accounts and automation identities

Don't assume every application uses the same identity provider. Some systems may rely on separate local accounts or legacy authentication methods that are not covered by your existing MFA policies.

For every identity and application, document:

• Whether MFA is supported
• Whether MFA is enabled and enforced
• Which authentication methods are permitted
• Where password-only authentication is still possible

2. Enforce MFA Through Centralized Policies

Once you've identified every access point, enforce MFA through centrally managed policies rather than relying on individual users to enable it themselves. For Microsoft environments, common enforcement options include:

• Security Defaults
• Conditional Access
• Microsoft mandatory administrator MFA
• Per-user MFA (primarily for legacy scenarios)

Organizations with Microsoft Entra ID P1 or P2 licensing should generally use Conditional Access because it provides greater flexibility and control. Security Defaults offer a strong baseline for smaller environments that do not require advanced policy management.

Where possible, policies should account for:

• Users and security groups
• Administrator roles
• Applications and cloud services
• Devices
• Geographic locations
• Remote access
• Sign in risk and device compliance

3. Prioritize High Risk Accounts

Although every user should eventually be protected by MFA, some accounts present significantly greater business risk if compromised. These users should receive the strongest authentication methods first. Priority accounts typically include:

• Global and system administrators
• Microsoft 365 administrators
• Security and backup administrators
• Finance and payroll personnel
• Executive leadership
• Human resources teams
• IT support staff
• Compliance and legal personnel
• Users with access to sensitive business data

For these accounts, phishing resistant authentication methods such as passkeys or FIDO2 security keys provide the strongest protection against modern identity attacks.

4. Eliminate Security Gaps and Exceptions

Even well-designed MFA policies can become ineffective if exceptions accumulate over time. Regularly review your environment for common gaps, including:

• Legacy authentication protocols
• Shared administrator accounts
• Permanently excluded users or groups
• Applications outside your identity platform
• VPN or remote access services without MFA
• Weak account recovery procedures
• Service accounts using standard user credentials
• Older applications or devices that cannot support modern authentication

Every approved exception should be documented with a business justification, an owner, compensating security controls, and a scheduled review date. Temporary exceptions should also have a clearly defined expiration date.

5. Evaluate and Improve Continuously

MFA enforcement is not a one-time project. As your business grows, employees join or leave, applications change, and new threats emerge. Regular reviews help ensure your policies continue providing the protection you expect. Monitor your environment on an ongoing basis by reviewing:

• Users covered by MFA
• Applications protected by MFA
• Privileged accounts using phishing resistant authentication
• Active policy exceptions
• Legacy authentication attempts
• MFA registration rates
• Authentication methods in use
• Account recovery and factor reset activity
• Risky or unusual sign in attempts
• Guest and contractor access
• Newly connected applications and services

The success of an MFA program should not be measured by whether a policy exists. It should be measured by whether every appropriate user and application is protected, risky sign ins are challenged or blocked, and authentication policies continue to evolve as your business and technology environment change.

How to Roll Out MFA Without Disrupting Employees

Rolling out MFA across an organization requires more than enabling a policy and expecting employees to adapt. Without proper planning, businesses may experience account lockouts, increased help desk requests, and frustration from users who are unfamiliar with the new authentication process.

A phased rollout allows you to strengthen security while minimizing disruption to daily operations:

1. Inventory Your Users and Systems

Before enforcing MFA, identify who needs access and which systems will be affected. Your inventory should include employees, administrators, contractors, remote users, business applications, VPNs, cloud services, and any automated processes or service accounts. This review also helps identify legacy applications or older systems that may not support modern authentication and require additional planning.

2. Choose Approved Authentication Methods

Not every MFA method offers the same level of protection. Decide which authentication methods employees can use and which stronger methods should be required for privileged or high-risk accounts. Where possible, encourage users to register more than one authentication method. Having a secure backup option helps reduce downtime if a phone is lost, replaced, or unavailable.

3. Establish Secure Recovery Procedures

Account recovery is just as important as authentication. Employees should know how to regain access if they lose a device or cannot complete MFA. Document a clear recovery process that includes identity verification before authentication methods are reset or replaced. Recovery codes, Temporary Access Passes, and other recovery credentials should be protected with the same level of care as primary authentication methods.

4. Communicate the Rollout Early

Clear communication helps reduce confusion and support requests. Before enabling MFA, let employees know:

• Why MFA is being introduced
• Which systems will require MFA
• Which authentication methods they can use
• When enforcement will begin
• How to register their authentication methods
• Where to get help if they experience issues
• What to do if they lose or replace a registered device

Providing this information in advance gives employees time to prepare and reduces last-minute registration issues.

5. Test With a Pilot Group

Before enforcing MFA across the entire organization, test your policies with a representative group of users. Include employees from different departments, remote workers, managers, IT staff, mobile users, and anyone who relies on critical business applications. A successful pilot should confirm that normal sign-ins work as expected while also validating scenarios such as password resets, device replacement, and account recovery.

6. Validate Policies Before Full Enforcement

If you're using Microsoft Conditional Access, consider testing new policies in Report-only mode before enforcing them. This allows administrators to review sign-in activity, identify unexpected impacts, and adjust policies before they affect employees. Testing first helps reduce disruptions and gives IT teams confidence that enforcement rules are working as intended.

7. Roll Out MFA in Phases

Instead of enforcing MFA for everyone at once, introduce it gradually. Many organizations begin with administrators and other high-risk users, followed by remote workers, departments that handle sensitive information, and finally the remaining workforce. After each phase, monitor metrics such as registration completion, account lockouts, authentication failures, factor reset requests, and application compatibility issues. Addressing problems early helps ensure a smoother rollout as MFA is expanded across the organization.

Which Accounts Should Be Protected First?

The final objective should be wide coverage, but some accounts need earlier attention because their compromise could create greater damage. Recommended rollout priority:

1. Global, domain, and system administrators
2. Email, cloud, security, and backup administrators
3. Finance and payment users
4. Executives and senior leaders
5. Remote-access and VPN users
6. Human resources and compliance users
7. IT help desk and password-reset personnel
8. All remaining employees
9. Guests and contractors
10. Emergency and specialized accounts

CISA recommends starting with administrator accounts, remote access, and employees who handle sensitive data, while Microsoft advises requiring MFA for all users, including administrators and financial officers.

An organization with MFA on 98% of accounts may still face substantial risk if the remaining 2% contains administrators, backup operators, remote-access accounts, or other high-impact identities.

Secure MFA Registration and Account Recovery

An MFA strategy is only as strong as the process used to register, reset, and recover authentication methods. Even the most secure authentication system can be compromised if attackers can convince a help desk agent to replace a user's registered device or reset their authentication method without proper verification.

For this reason, account recovery should be treated as a critical part of your identity security strategy, not simply an administrative task. A secure recovery process should:

• Verify a user's identity through an approved process before making any changes.
• Avoid relying solely on publicly available information, such as social media profiles or company websites.
• Require additional approval before resetting MFA for privileged or administrative accounts.
• Notify users whenever an authentication method is added, changed, or removed.
• Remove outdated authentication methods once new ones have been verified.
• Review active sessions after an authentication reset and revoke access where appropriate.
• Record who approved and completed each reset for auditing purposes.
• Use temporary, time limited recovery credentials whenever possible.
• Escalate unusual or repeated recovery requests for additional review.

Identity standards such as NIST SP 800-63 recognize authenticator enrollment, recovery, and lifecycle management as essential parts of secure identity management. In other words, protecting the sign in process alone is not enough. Organizations must also secure the processes that allow users to regain access.

The strongest MFA method offers limited protection if an attacker can bypass it through weak identity verification or an insecure account recovery process.

How to Verify That MFA Is Actually Being Enforced

Enabling an MFA policy is only the beginning. To confirm it is working as intended, organizations should regularly review how the policy is performing and whether it is protecting every user, application, and sign in scenario that it was designed to cover.

Metric	What It Reveals
Users Covered by MFA	Whether all intended employees, administrators, contractors, and guest users are protected by MFA policies.
Applications Protected by MFA	Whether critical business applications require MFA or can still be accessed without it.
Privileged Accounts Using Phishing Resistant MFA	Whether high-risk administrative accounts are using the strongest available authentication methods.
Active Policy Exclusions	Whether approved exceptions are creating unnecessary security gaps.
Legacy Authentication Attempts	Whether users or applications are attempting to sign in using protocols that bypass MFA.
MFA Registration Completion	Whether users have successfully enrolled approved authentication methods before enforcement begins.
Authentication Reset Activity	Whether frequent factor resets indicate usability issues or potential security risks.
Risky Sign-ins Blocked or Challenged	How effectively MFA policies detect and respond to suspicious authentication attempts.
Guest and External User Coverage	Whether vendors, contractors, and guest accounts are protected by the same security policies as employees.
New Applications Reviewed	Whether newly deployed applications are evaluated and included in MFA enforcement policies.

Review individual policy assignments and sign-in results rather than relying on the existence of a policy alone. Microsoft specifically notes that an enabled Conditional Access policy may still leave users unprotected because of targeting choices and exclusions.

A monthly review should examine new users, departed employees, exceptions, recovery events, legacy access, administrator methods, and applications added since the previous review.

Microsoft 365 MFA Enforcement Options

Microsoft 365 offers several ways to enforce MFA, each designed for different business needs. The right option depends on your organization's size, Microsoft licensing, security requirements, and the level of control you need over authentication policies.

Security Defaults

Security Defaults provide a built in security baseline for organizations that want stronger identity protection without creating complex policies. They automatically require MFA registration, enforce MFA for administrator accounts, challenge users when appropriate, and block certain legacy authentication methods.

For many small businesses, Security Defaults offer a simple way to improve account security without ongoing policy management. However, they provide limited customization and may not meet the needs of organizations with more complex security or compliance requirements.

Conditional Access

Conditional Access gives organizations greater control over when and how MFA is enforced. Instead of applying the same rules to everyone, administrators can create policies based on factors such as:

• Users or security groups
• Administrator roles
• Applications and cloud services
• Device compliance
• Geographic location
• Sign in risk
• Authentication strength
• Client applications
• Session conditions

Conditional Access is the recommended approach for organizations with Microsoft Entra ID P1 or P2 licensing because it allows businesses to build authentication policies that align with their specific security requirements. Before enabling new policies, Microsoft recommends testing them in Report-only mode and rolling them out in phases.

Per User MFA

Per User MFA applies MFA settings directly to individual accounts. While it remains available for some environments, Microsoft generally recommends using Security Defaults or Conditional Access instead because they provide more centralized and flexible policy management.

Microsoft's Mandatory Administrator MFA

Microsoft has introduced mandatory MFA requirements for administrative access across services such as Azure, Microsoft Entra, Intune, and Microsoft 365. These requirements strengthen the security of privileged Microsoft accounts, but they do not automatically protect every user, application, or third party service within your organization.

Businesses are still responsible for enforcing MFA across employee accounts, VPNs, cloud applications, backup platforms, and other systems that fall outside Microsoft's mandatory requirements.

When Does an SMB Need Managed MFA Enforcement?

Many small and midsized businesses can enable MFA on their own. The challenge is maintaining consistent enforcement as employees, applications, devices, and business requirements change over time.

If any of the following situations sound familiar, it may be time to seek managed assistance:

• You're unsure which users or applications are currently protected by MFA.
• Authentication policies haven't been reviewed in months or years.
• Exceptions and policy exclusions have accumulated over time.
• Administrator accounts still rely on weaker authentication methods.
• Your business doesn't have dedicated identity or security expertise.
• Microsoft licensing and MFA policy options are difficult to navigate.
• Guest users, contractors, or third party partners require regular access.
• Remote access is managed separately from the rest of your identity environment.
• Account recovery and MFA reset procedures are inconsistent.
• Security alerts and sign in activity aren't reviewed regularly.
• Producing audit or compliance evidence is time consuming.
• Employees use multiple cloud platforms and business applications.

A managed IT provider can help assess your current environment, identify authentication gaps, design appropriate MFA policies, coordinate user enrollment, test new configurations, document approved exceptions, and monitor authentication activity as your environment evolves.

However, it's important to remember that security governance remains the organization's responsibility. Business leaders should continue to approve access requests, authentication standards, policy exceptions, and risk decisions, even when day to day administration is handled by a trusted IT partner.

Strengthen MFA Enforcement With NzingaNet

Enabling MFA is an important security step, but it is not a one time task. User access changes, new applications are added, employees leave, and authentication policies need regular review to ensure they continue protecting your business.

NzingaNet helps small and midsized businesses implement and maintain stronger identity security through MFA enforcement, Microsoft 365 management, email security, EDR, security monitoring, and ongoing access reviews. Our managed IT services help identify gaps in authentication policies, improve account protection, and ensure security controls continue to align with your business needs.

A practical MFA review should evaluate:

• Which users and administrators have MFA enabled
• Which applications and systems require stronger authentication
• Whether approved authentication methods meet security requirements
• Whether legacy authentication creates unnecessary risk
• How MFA resets and account recovery requests are handled
• Whether sign in activity is monitored for suspicious behavior
• Which accounts should move toward phishing resistant authentication methods

Schedule a free cybersecurity assessment with our team to identify MFA gaps, review authentication policies, and strengthen your overall security posture.

COMMON QUESTIONS

Frequently Asked Questions

Is enabling MFA the same as enforcing it?

No. Enabling MFA means the capability is available or activated. Enforcement means a policy requires it for selected users, applications, or sign-in conditions. A user may have an authenticator registered while still being able to enter certain systems without an MFA challenge.

Does MFA stop 80% of cyberattacks?

No. Microsoft reported that tenants using security defaults experienced 80% fewer compromises, but security defaults include MFA and the blocking of legacy authentication. Microsoft separately reports that MFA can block more than 99.2% of automated account compromise attempts. The 80% figure does not apply to every form of cyberattack.

Which MFA method is the most secure?

Phishing-resistant methods such as passkeys, FIDO2 security keys, Windows Hello for Business, and certificate-based authentication provide the strongest protection. They use cryptographic verification tied to the legitimate service, making them much harder to capture or replay through fraudulent sign-in pages.

Should MFA be required for every employee?

Broad enforcement should be the objective because any employee account may contain business data or provide access to company applications. Administrators, finance personnel, executives, remote users, and employees handling sensitive information should receive the earliest attention and stronger methods where possible.

Can attackers bypass MFA?

Yes. Attackers may use adversary-in-the-middle phishing, stolen session tokens, malicious OAuth permissions, MFA fatigue, weak recovery procedures, or compromised endpoints. Phishing-resistant authentication and secure account-recovery processes reduce several of these risks, but MFA still needs support from other security controls.

What happens if an employee loses a phone?

The organization should use a documented recovery process that verifies the employee's identity before registering another method. Old factors and active sessions should be reviewed or revoked. Users should ideally have a secure backup authentication method registered before a device is lost.

How much does MFA enforcement cost?

The cost depends on the identity platform, number of users, licensing, authentication methods, applications, devices, and implementation complexity. Expenses may include Entra licensing, security keys, policy design, user enrolment, application remediation, training, and ongoing monitoring. A proper assessment should identify required controls before pricing the rollout.