MFA and Account Recovery Checklist

Identify email, administrator, finance and other business-critical accounts. Include the owner and the service used for account recovery.

Evidence to look for: A prioritized account list without passwords or recovery codes.

Evaluate phishing-resistant passkeys or FIDO-based security keys where supported. Check device compatibility, user verification and your organization's access policies.

Evidence to look for: A documented method selected for each service.

Confirm who assists users, how approved devices are registered and how access is recovered if enrolment goes wrong.

Evidence to look for: An enrolment and support plan.

Confirm that MFA is actually enabled for the intended users and administrators. Assign an owner to services that cannot support it.

Evidence to look for: A service-side coverage report and an exception list.

Use a different strong password for each service that still needs one. Use an approved password manager and protect access to it.

Evidence to look for: An agreed password-management process.

Teach people to reject unexpected prompts and report them using a trusted contact method. Never share one-time sign-in codes with someone requesting them.

Evidence to look for: A short instruction included in team guidance.

Where the service supports it, arrange a second authorized method or spare security key. Confirm who may use it and under what conditions.

Evidence to look for: A recovery-method inventory that excludes secret values.

Protect recovery codes and administrator recovery details in approved storage. Make sure recovery does not depend entirely on the account or device being recovered.

Evidence to look for: A documented storage and access process.

Use the provider's supported process to review how a lost authenticator is reported, access restored and the old method removed. Coordinate any live test with IT.

Evidence to look for: A recorded walkthrough and owner for unresolved gaps.

Keep authenticator devices and passkey stores updated and secured with an appropriate screen lock. Review the account that synchronizes credentials.

Evidence to look for: Device and credential-store protection settings reviewed.

Review old accounts, registered authenticators and supplier access through your offboarding process. Follow current vendor instructions when compromise is suspected.

Evidence to look for: An offboarding and account-change record.

Revisit service compatibility, recovery ownership and exceptions when staff, devices or important applications change.

Evidence to look for: A review owner and next review date.