credentials Controls

Multi-factor authentication is required for all user accounts

Unique credentials are used and shared accounts are eliminated

Strong password policies are enforced at the identity provider, including breached-password checks