# 1.2 Ensure Multi-Factor Authentication is Enabled for All Non-Service Accounts (Manual) - Source: https://support.icompaas.com/support/solutions/articles/62000232871-1-2-ensure-multi-factor-authentication-is-enabled-for-all-non-service-accounts-manual- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### Profile Applicability: ### Level 1 ### Description: Enable multi-factor authentication (MFA) for all non-service accounts in Google Cloud Platform (GCP) to enhance login security. ### Rationale: Requiring MFA adds an additional layer of security by requiring users to verify their identity through multiple methods. This protects accounts from attackers exploiting stolen or weak credentials. ### Remediation: Test Plan: #### Using Google Cloud Console: 1. Log in to Google Cloud Console at [Google Cloud Console](https://console.cloud.google.com/). 2. Navigate to the Google Workspace Admin Console ([admin.google.com](https://admin.google.com/)).Use an administrator account with permissions to manage users.                                                                      ![](https://support.icompaas.com/assets/kb/5f8e20c9848cb45c.png) 3. In the Admin Console, go to Security > Authentication > 2-Step Verification. 4. Review the enforcement status of MFA for all users. 5. Verify that 2-Step Verification is turned on and enforced for all non-service accounts.      ![](https://support.icompaas.com/assets/kb/44feb8fc44c0ff24.png) #### Using Google Cloud CLI - List IAM Policies: Retrieve the IAM policies for your organization:(Replace ORGANIZATION\_ID with your organization ID).   gcloud organizations get-iam-policy ORGANIZATION\_ID 2. Review the members field in the output to identify user accounts (e.g., user@example.com). 3. Check 2-Step Verification Status: Use the Google Workspace Admin API to check if MFA is enabled for each account: - Install the Google Admin SDK. - Run the script to check MFA status for users. ### Implementation: #### Using Google Cloud Console 1. Enable MFA: - In the Google Workspace Admin Console, go to Security > Authentication > 2-Step Verification. - Turn on 2-Step Verification if it is not already enabled. ![](https://support.icompaas.com/assets/kb/2afd190481ed1f4c.png) 2. Enforce MFA: - Under 2-Step Verification, select Enforcement. - Choose On for everyone or specify organizational units if applicable. - Save the settings. 3. Communicate with Users: - Notify users to complete their MFA setup. Provide a deadline for compliance. #### Using Google Cloud CLI 1. Enable MFA: Use the Admin SDK Directory API to enforce MFA for all users in your organization. For example: gcloud identity accounts update-mfa-policy \\ --enforce \\ --organization-id ORGANIZATION\_ID - Replace ORGANIZATION\_ID with your organization’s ID. 2. Verify Enforcement: Check the status of MFA enforcement by running: **gcloud identity accounts list-mfa-policies --organization-id ORGANIZATION\_ID** 3. Communicate Requirements: Inform users of the MFA policy enforcement and provide guidance on completing the setup. ## Backout Plan: Step 1: Disable MFA Enforcement (Temporarily) If necessary, temporarily disable MFA enforcement: gcloud identity accounts update-mfa-policy \\ --disable-enforce \\ --organization-id ORGANIZATION\_ID Step 2: Restore User Access (If Impacted) Re-add affected users if access was revoked: gcloud projects add-iam-policy-binding PROJECT\_ID \\ --member="user:RESTORED\_EMAIL" \\ --role="ROLE" Step 3: Notify Users & Adjust Policies - Communicate **access restoration to impacted users.** Adjust IAM policies to ensure that only necessary accounts have permissions. ### ### **References:** 1. **[Securing GCP Accounts with MFA](https://cloud.google.com/solutions/securing-gcp-account-u2f)** 2. **[Google Account MFA Setup](https://support.google.com/accounts/answer/185839)** ### **CIS Controls:**

Control

Description

IG 1

IG 2

IG 3

6.3 Require MFA for Externally-Exposed Applications

Enforce MFA for all externally accessible enterprise or third-party applications. MFA via directory services or SSO is acceptable.

✅

✅

✅

16.3 Require Multi-Factor Authentication

Enforce MFA for all user accounts across all systems, whether managed on-premises or by a third party.

✅

✅

✅

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.