Policy & Guidance

Sample excerpt — not for client use. Tier 1 Policy Template (Sanitized Example).

Use case

A lightweight MFA standard for small organizations using Microsoft 365 and connected cloud apps.

What this sample shows

Plain-English requirements, clear user expectations, and practical enrollment/recovery steps.

Purpose

Require MFA for organizational accounts to reduce account takeover risk and protect email, files, and sensitive information.

Scope

Applies to employees, volunteers, contractors, and IT support accessing organizational systems (including Microsoft 365 and connected third-party apps).

Key Requirements (Day-to-Day)

• Do not share passwords or approve MFA prompts for anyone else.
• MFA is required for interactive sign-ins to Microsoft 365 and connected applications.
• Unexpected prompt: deny it and report immediately.

Approved MFA Methods (Preferred Order)

• Authenticator app with number matching / push approval (preferred)
• FIDO2 security key (if available)
• SMS/voice codes only as a time-limited exception

Enrollment, Recovery, and Reporting

• Enroll during onboarding and keep at least one backup method when feasible.
• Lost/replaced MFA device: report immediately so methods can be reset and the account protected.
• Suspected phishing or unusual prompts: stop and report right away via the designated channel.

Exceptions

Exceptions must be documented, time-bound (max 30 days unless re-approved), and include compensating controls and a plan to remove the exception.

Illustrative portfolio sample. Final requirements and authentication methods should be tailored to the organization’s technology environment, risk profile, contractual obligations, and applicable legal or regulatory requirements.