Description:
This control ensures that Multi-Factor Authentication (MFA) is enforced for all users within the Zoho organization. MFA requires users to provide an additional authentication factor beyond their password before gaining access to organizational resources.


Rationale:
Enforcing MFA for all organization members helps protect accounts from credential theft, phishing attacks, password reuse, and unauthorized access. MFA strengthens identity verification and significantly reduces the likelihood of account compromise.


Impact:

  • Reduces the risk of unauthorized access to user accounts.

  • Protects against compromised or stolen credentials.

  • Improves the organization's overall security posture.

  • Supports compliance requirements related to identity and access management.

  • Requires users to complete an additional authentication step during sign-in.


Default Value:
Disabled by default. Administrators must explicitly configure Zoho Directory or Zoho One to enforce Multi-Factor Authentication for organization members.


Remediation

Test Plan

  1. Sign in to the Zoho Admin Console with administrative privileges.

  2. Navigate to Security Policies or Multi-Factor Authentication Settings.

  3. Verify that MFA enforcement is enabled for all users.

  4. Select a user account that is subject to the MFA policy.

  5. Attempt to sign in to the account without completing Multi-Factor Authentication.

  6. Verify that the user is prompted to complete MFA before access is granted.

  7. Verify that MFA enforcement applies to all required organization members.

  8. If MFA is not enforced for all required users, follow the Implementation Steps to remediate the issue and repeat the test.


Implementation Steps:

  1. Sign in to the Zoho Admin Console with administrative privileges.

  2. Navigate to Directory → Security Policies.

  3. Create a new security policy or edit an existing policy.

  4. Select the users, groups, or organizational units to which the policy will apply.

  5. Enable Multi-Factor Authentication (MFA).

  6. Configure the allowed MFA methods according to organizational policy.

  7. Set MFA enforcement to Mandatory.

  8. Save the security policy configuration.

  9. Assign the policy to all applicable organization members.

  10. Verify that users are required to complete Multi-Factor Authentication when signing in.

  11. Verify that MFA enforcement is applied to all required organization members.


Backout Plan:

  1. Sign in to the Zoho Admin Console with administrative privileges.

  2. Navigate to Directory → Security Policies.

  3. Edit the applicable security policy.

  4. Disable Multi-Factor Authentication (MFA) or change the enforcement setting as required.

  5. Save the configuration changes.

  6. Verify that authentication behavior reflects the updated configuration.


References: