Management statement
Privileged MFA implemented
Control owner reports MFA deployment across administrator identities.
Illustrative scenario · fictional company and facts
What would ORI help us verify next?
A fictional hybrid-services company reports privileged MFA coverage and regular access reviews. A sample identity export then identifies privileged accounts without enrolled MFA. This worked example explains the questions a security team should ask before treating the control as confirmed.
Example purpose: explain a decision workflow. The numbers and case details below are illustrative, not a saved ORI engine execution, client result or calibrated loss estimate.
1. Declared posture
Supporting evidence
Identity export
Sample dataset: 12 privileged accounts; 10 show MFA enrolled, 2 do not. These figures are invented solely for illustration.
Assessment question
What is the actual scope?
Are the two accounts break-glass exceptions, inactive identities or unprotected privileged access?
2. Evidence-based interpretation
What the export supports
The supplied fictional export contains two privileged identities without an enrolled MFA indicator.
What remains unverified
Whether the export is complete and current; whether conditional access is enforced elsewhere; whether the accounts can actually authenticate.
Why a single score is insufficient
Even a mature control declaration needs scope and evidence quality checks before an operational conclusion is defensible.
3. Practical verification priorities
- Confirm the privileged population against the identity provider and cloud control planes.
- Validate MFA enforcement—not just enrollment—for active privileged sign-ins.
- Check exception approvals, account ownership and compensating restrictions.
- Repeat the assessment using a dated, complete export with documented provenance.
4. Reproducible ORI engine results
These results are generated from a published synthetic questionnaire by the actual FortiSec ORI scoring engine. Compare a declared control, an evidence-pending control and unknown dependencies.
Loading published engine report…
5. What a FortiSec engagement can provide
A review of the questionnaire and available evidence, a register of material gaps and assumptions, and a prioritized verification/remediation discussion. Scope and deliverables are agreed before work begins.
Explore the live ORI interface → Request a guided walkthrough →