How to answer 'Is multi-factor authentication required for production access?' on a SIG Lite
I. Reviewer Guidance & Pitfalls
State the factor type (TOTP vs hardware key), the scope (production vs all internal tools — reviewers probe the difference), and where the requirement is enforced (SSO/IdP policy). A scope mismatch between two answers on the same form is a top-3 rejection cause.
II. Example Answer Passing Enterprise Audit
Compliant Response
Sealed · IAM-05
Yes. Production access requires SSO with hardware-key MFA enforced at the IdP; access reviews run quarterly (SOC 2, CC6.2).
Filling out a CAIQ or SIG Lite right now?
QuietQuestionnaire drafts answers with citations pulled directly from your own SOC 2 report, catches contradictions reviewers reject, and locks exports behind cryptographic human sign-off.
No spam · No credit card · Confidential by default