A7.16: Has MFA been applied to all administrators of your cloud services?

What does A7.16 ask?

A7.16 asks: “Has MFA been applied to all administrators of your cloud services, excluding any listed in A7.15 that do not provide it?”

A7.16 asks whether MFA has been applied to all administrators of your cloud services, excluding any listed in A7.15 that do not provide it. The guidance says all administrator accounts on cloud services must apply multi-factor authentication in conjunction with a password of at least 8 characters, and that the assessment will fail if the answer is no.

The requirement: implement MFA, where available; authentication to cloud services must always use MFA. Administrators are the first target because the requirements say you should always use MFA to give administrative accounts extra security, and accounts that are accessible from the internet.

Administrators means every account with elevated rights on any service in A2.9: global and role admins in Microsoft 365 or Google Workspace, the owner login on the accounting platform, the MSP's engineers, and break-glass accounts. Setup guides: Microsoft 365 and Entra ID, Google Workspace, AWS, Azure.

What must be true to answer Yes to A7.16?

You can answer Yes to A7.16 only when all of the following are true today, across every device, user and cloud service in scope.

• Every cloud service in A2.9 that offers MFA has it enforced, not merely available, for all admin accounts, including the MSP's and any emergency access account.
• The password element of each admin login is at least 8 characters with no maximum.
• No admin account is excluded from the MFA policy for convenience, automation or legacy authentication.
• Services with no MFA option are listed in A7.15 and are the only exceptions.

Why do applicants fail A7.16?

A common reason applicants fail A7.16: security defaults or a conditional access policy that excludes a service account, a shared support account or the emergency access account.

How do you fix a failing A7.16 answer?

If your answer to A7.16 would not pass today, fix the control first and then write the answer. In order:

1. List every admin account on every cloud service, including break-glass and MSP accounts.
2. Enforce MFA on all of them through conditional access, security defaults or each service's own setting.
3. Remove MFA exclusions and block legacy authentication.
4. Test by signing in as an admin from a private browser and confirming the MFA prompt.

How do assessors check A7.16?

What evidence should you keep for A7.16?

The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A7.16:

• The conditional access or security defaults configuration, with any exclusions explained.
• For each other cloud service, a screenshot showing MFA enforced for admin accounts.