Identity, Access and Device Control

Lesson 02 gave identity and access one row in an eleven-row table and zero trust one short section. Lesson 10 gave bring-your-own-device (BYOD) one policy line and offboarding one checklist. A manager who has to approve the purchase of single sign-on, decide whether the sales team may read company email on personal phones, or answer the insurance application question "do you require MFA for all administrator access?" needs a fuller treatment. This lesson fills the gap and builds on those two.

The hands-on setup steps for a small office are in the sibling modules: accounts, passwords and two-step sign-in, phones, tablets and mobile and, for the household version, passwords, two-step and passkeys. This lesson stays at the level of decisions, evidence and money. Where a law sets the floor, the rule is cited. Where the law is silent, the benchmark is named. The laws that create the legal duty are in lesson 06, and the household version of identity advice is in the module 71 lesson linked above.

Identity is the new perimeter

An office network used to be a building with a locked door. Staff, files and servers were inside, and the firewall was the door. Now the files sit in cloud services, the staff sit in kitchens and airports, and the phone in a pocket holds the same mailbox as the desk computer. The thing that decides whether a stranger can read your payroll folder is whether that stranger can pass the sign-in. NIST SP 800-207 (final, August 2020) describes the shift: protection moves from the network edge to users, assets and resources, and trust is not granted because of where a request comes from (NIST, as of October 2026).

That makes four questions the management questions about identity.

• Who has an account? Every employee, contractor, vendor, shared mailbox, service account and forgotten test login counts.
• How do they prove who they are? A password alone, a password plus a code, or something that cannot be handed to a fake website.
• What can each account do? An ordinary user, a finance approver, an administrator.
• When does each account end? On the day the job ends, at the end of a contract, or when nobody has used it for 45 days.

The CIS Critical Security Controls v8.1 treat the first and third questions as Controls 5 (Account Management) and 6 (Access Control Management) (CIS control list, as of October 2026). The safeguard titles and Implementation Group (IG) levels below come from CIS's published assessment specification. IG1 is the baseline group, meant for small organizations with limited IT staff.

CIS safeguard	Title	Starts at	Plain meaning
5.1	Establish and maintain an inventory of accounts	IG1	A list of every account, with an owner
5.2	Use unique passwords	IG1	No sharing one password across systems
5.3	Disable dormant accounts	IG1	Turn off accounts nobody uses
5.4	Restrict administrator privileges to dedicated administrator accounts	IG1	Admins use a separate account for admin work
5.5	Inventory of service accounts	IG2	Know which accounts run software, not people
5.6	Centralize account management	IG2	Single directory or SSO
6.1 and 6.2	Access granting and revoking processes	IG1	Joiner, mover and leaver, written down
6.3, 6.4 and 6.5	MFA for externally exposed applications, remote network access and administrative access	IG1	MFA where an outsider could reach
6.6 and 6.7	Inventory of authentication systems; centralize access control	IG2	One front door for sign-in
6.8	Define and maintain role-based access control	IG3	Access follows job roles, documented

Read the table as a purchase order. A 60-person firm that does the IG1 rows has done most of what an insurer checks. SSO and centralized management (the IG2 rows) are what you buy next, and role-based access control is what you grow into at several hundred staff.

Single sign-on and the MFA strength ladder

Single sign-on (SSO) lets people sign in once, to a company-controlled identity service, and reach many applications. The business gains two things at once. Staff stop reusing passwords on twenty different vendor sites, and the company gets one switch to turn off when someone leaves. Microsoft Entra ID and Google Workspace both act as identity providers for thousands of other applications, and stand-alone identity services exist too. A manager does not need to pick the brand first. The first question is whether every application that holds sensitive data can be put behind the same sign-in. Applications that cannot join (some are too old or too small) go on an exceptions list with an owner, since each is a separate password to lose.

Multi-factor authentication (MFA) asks for a second kind of proof. The methods differ a great deal in how well they hold up against a criminal who sends the victim to a fake login page and relays whatever the victim types. CISA's fact sheet Implementing Phishing-Resistant MFA (October 2022) sorts them:

The ladder follows CISA's fact sheet. Higher is stronger against a phishing attack. Move people up the ladder in order of what they can reach.

CISA calls FIDO/WebAuthn "the only widely available phishing-resistant authentication" in that fact sheet, and lists PKI-based sign-in (government smart cards are the example) as the other resistant type. It lists text and voice codes, app one-time codes and plain push approvals as phishable, and says number matching still leaves push vulnerable to phishing while stopping push bombing. A passkey is the consumer name for a FIDO credential. A security key is a small hardware token that holds one.

NIST SP 800-63B-4, the federal digital identity guideline, was finalized on July 31, 2025 and replaced the 2020 edition (NIST). Three points from the full text (800-63B-4) shape management policy.

• Phishing resistance is required at the highest assurance level (AAL3), and at AAL2 the verifier must offer at least one phishing-resistant option. Federal agencies must require it for staff, contractors and partners who reach federal systems.
• Out-of-band codes over the phone network (SMS and voice) are restricted, and email must not be used for out-of-band authentication.
• For passwords, a password used alone must be at least 15 characters, and one used only as part of MFA at least 8. Composition rules (a symbol, a capital) are barred, and periodic forced changes are barred unless there is evidence of compromise.

The guideline binds federal systems, not private firms. It still matters because auditors, insurers and customers use NIST as the yardstick. A policy that forces a new password every 90 days, or demands a symbol, runs against that yardstick, and it makes people write passwords on sticky notes.

What to buy first

Group	Why first	Minimum method	Better
Administrators of email, identity, backup and payment systems	One stolen admin account is a company-wide event	App-based MFA with number matching	Two FIDO2 keys each; phishing-resistant method required in policy
People who release money or change bank details	Business email compromise targets them	App-based MFA	Security key or passkey, plus the call-back rule from lesson 10
Executives and assistants with delegate access	Targeted by name, and they hold broad access	App-based MFA	Passkey on managed device
Everyone else	Stolen passwords are cheap	App-based MFA, no text codes where an alternative exists	Passkeys as devices allow
Contractors and vendor staff	Often skipped, always exposed	MFA enforced by your tenant, with an end date on the account	Managed access only to the one application

The FTC Safeguards Rule sets a legal floor for the non-bank financial businesses it covers, such as tax preparers, mortgage brokers, auto dealers and many collection agencies: MFA for "any individual accessing any information system", unless the Qualified Individual approves in writing an equivalent or stronger control (16 CFR 314.4(c)(5), as of October 2026). Note the breadth. It is not limited to remote access or administrators.

Joiner, mover, leaver, and the access review

Access problems seldom start with a hack. They start with a job change. A bookkeeper moves to operations and keeps the payroll folder. A summer contractor leaves in August and the account lives into the next year. Three process moments catch these. CIS safeguards 6.1 and 6.2 call for a written process for granting and for revoking access, and 5.3 for disabling dormant accounts.

Moment	Trigger	Who starts it	What happens	Evidence kept
Joiner	Signed offer or contract	HR or the hiring manager, by ticket	Account built from a role template; MFA enrolled before first use; device assigned; access to the minimum set	Ticket with approver, role template used, MFA enrollment date
Mover	Transfer, promotion, new project	HR, with the new manager	New role access added; old role access removed the same week	Ticket showing what was added and removed
Leaver	Resignation or termination date	HR, a day ahead where possible	At the stated time: sign-in disabled, sessions and tokens revoked, SSO removed, shared secrets reset, mailbox converted or forwarded, devices recovered	Ticket timestamp compared with HR separation time
Contractor	Contract start	The sponsoring manager	Account created with an expiry date equal to the contract end	Expiry date in the directory
Dormant	No sign-in for 45 days (the period CIS safeguard 5.3 sets, where the system supports it)	Automated report to IT	Account disabled, owner asked, deleted after a further hold period	Monthly dormant-account report

The leaver row is where firms get hurt. Turning off a password does not always end a session that was already issued, so the checklist must revoke sessions and tokens too, remove the person from SSO and from any shared vault or shared mailbox, and change every shared secret the person knew. Lesson 10 covers the HR side of exit, including preservation of evidence when a departing employee takes files. This lesson covers the technical clock: the target is that access ends at the moment of separation, and the metric is the share of leavers disabled within one business day.

The quarterly access review

An access review is a short, dated sign-off. Each system owner or department head gets a list of who has access to what, strikes what is no longer needed, and signs. For a 150-person firm this takes a manager about 20 minutes a quarter if the list is clean. Review these first: administrator roles, finance and payroll systems, the customer database, shared drives with HR or legal material, and every external user. Keep the signed lists. They are the evidence for a SOC 2 audit, a Safeguards Rule risk assessment, a HIPAA access review, and an insurance renewal.

Privileged access: admin, shared, service and break-glass accounts

An administrator account can read everything, change everything and silence the alarms. It deserves a different set of rules from an ordinary account, and every major platform says so in its own guidance.

Account type	Rule	Source or reason
Administrator	A separate admin account used only for admin tasks, with a normal account for email and browsing. Few people hold it. No one stays signed in to it.	CIS 5.4; Google's admin guidance says the same, with security keys as the second factor and a spare key stored safely
Super administrator or global administrator	More than one, each held by a different person, so losing one account does not lock out the company. Named individuals, not a shared login.	Google Workspace admin best practices; Microsoft recommends two emergency accounts as well
Shared account	Avoid. Where a tool forces one, put the secret in a team password manager, log use, and reset it when anyone with access leaves.	Google: give each admin an identifiable account so audit logs show who did what
Service account	A list with an owner and a purpose for each. No interactive sign-in. Long random secret. Rotated when the owner leaves.	CIS 5.5 (starts at IG2)
Break-glass (emergency access) account	At least two, cloud-only, permanent top-level role, excluded from the policies that could lock them out, with a method different from normal admins (for example a FIDO2 key in a safe). Alert on every sign-in. Test at least every 90 days.	Microsoft Learn emergency access guidance
Vendor and MSP admin access	Named accounts in your tenant, with MFA, logged, and removed at contract end. Not a shared login from the vendor.	Lesson 09; lesson 18 on managed service providers

Microsoft's documentation adds a detail that managers miss: the break-glass accounts must not be tied to one person's phone, their credentials must not expire from inactivity, and any use should trigger a post-mortem to decide whether it was a drill, a real emergency or misuse. That is the sort of sentence an auditor can test. Ask your IT provider for the date of the last test and the alert it generated.

Zero trust as a decision table

Lesson 02 said zero trust is a set of habits, not a product. Here is the version a manager can approve. CISA's Zero Trust Maturity Model organizes the work in five pillars (identity, devices, networks, applications and workloads, and data), three cross-cutting capabilities (visibility and analytics, automation and orchestration, and governance), and maturity stages that run Traditional, Initial, Advanced, Optimal (CISA, version 2.0, written for federal agencies). The table translates the pillars into purchases for a firm with 10 to 500 people.

Pillar	Traditional (where many start)	Initial: do this year	Advanced: do when staff and risk grow
Identity	Passwords, some MFA, local accounts	SSO, MFA for all, admin accounts separated, quarterly review	Phishing-resistant MFA for most staff; sign-in risk checks
Devices	Whatever staff bring	Company laptops enrolled in management, disk encryption, patch status visible	Sign-in blocked from devices that fail health checks
Networks	Flat office network; VPN opens everything	Guest and device networks separated; remote access to named applications	Segments by role; outbound filtering
Applications and workloads	Many apps, separate passwords	Sensitive apps behind SSO; sharing limits set	Per-app policies; unmanaged apps found and approved or retired
Data	Open shared drives	Sensitive data located and labeled; access by group	Automatic labels; download limits on unmanaged devices

The engine that does the "if-then" work is called conditional access. Microsoft describes Conditional Access in Entra as its zero trust policy engine: policies combine signals (user, group, IP location, device, application and risk) and then require an action such as MFA, a compliant device, or a block (Microsoft Learn, as of October 2026). It requires Entra ID P1 licenses, and Microsoft says Microsoft 365 Business Premium customers can use its features. Risk-based policies need Entra ID P2. Google's counterpart, Context-Aware Access, can allow or block Gmail, Drive and Calendar based on IP address, location, security policy or operating system, with the example of allowing Drive for desktop only on company-owned devices in set regions (Google Workspace).

Security defaults or conditional access?

Question	Security defaults (Microsoft)	Conditional access
Cost	Included, no license	Entra ID P1, included in Business Premium
What it enforces	MFA registration for all users; MFA for admins at each sign-in; blocks legacy protocols; blocks device code flow; MFA for Azure management	Whatever you write: by group, app, location, device, risk
Customization	On or off only	Full
Fit	Firms with simple needs and no premium license	Firms that need device checks, contractor rules, exceptions
Catch	Cannot be used with conditional access	Needs an owner who reads the sign-in logs

Microsoft's page states that security defaults and Conditional Access cannot be used together, and that when switching you should turn on the Microsoft-managed Conditional Access policies right away, since they cover MFA for admins and users, MFA for Azure management and the block on legacy authentication. The page also says new tenants have security defaults on by default. The decision for a manager is short. If you pay for Business Premium or higher, ask your IT provider to move you to conditional access with a written policy list. If you do not, make sure security defaults are on.

Remote work and personal devices

NIST SP 800-124 Rev. 2 (May 2023) covers the security of mobile devices in the enterprise, including personally owned ones, and describes centralized device management and endpoint protection across the device life cycle (NIST). The management decision is how much control the business needs over a device, set against how much it may fairly claim over a device the employee owns.

Model	Who owns the device	Control tool	What the business can do	What it should not do	Typical fit
Company-owned, fully managed	Business	MDM enrollment	Enforce encryption, screen lock and patches; install apps; full remote wipe	Read personal photos or messages if personal use is allowed	Laptops, finance and admin staff, shared devices
Company-owned, personal use allowed	Business	MDM with work and personal separation	Full control of the work profile; wipe of device on loss	Track location after hours without notice	Field phones
Personal device, app-level control (MAM)	Employee	App protection policies, no enrollment	Require a PIN for work apps, block copy and paste to personal apps, remove company data from those apps only	Wipe the whole phone; see personal apps	Staff who need email and chat on a personal phone
Personal device, no control	Employee	None	Nothing	Allow access to sensitive data	Browser-only access to low-risk apps, if at all

Microsoft's documentation on Intune app protection policies explains the middle path. The policies work in the work context only and do not need the device to be enrolled. They can require a PIN to open corporate email, stop copy and paste of corporate data into personal apps, and restrict where company files can be saved. A selective wipe removes company data from the managed app without removing the app or personal data, whereas a full device wipe needs enrollment (Microsoft Learn). Microsoft recommends pairing the policies with Conditional Access for enforcement. Google and other platforms offer similar tools. The principle holds across vendors: protect the data inside the app, not the whole phone.

Employee privacy on personal devices

The business may set conditions for access to its data. It should not read an employee's personal messages, photos or browsing, and it should say so in the BYOD policy. Write down what the tool can see (device model, operating system version, whether a PIN is set, the list of company apps) and what it cannot see (personal apps, messages, photos). Describe what happens on loss: the work data is removed, and the personal data stays. Some states limit what employers may demand, such as access to personal social media accounts, and some require notice of electronic monitoring. Lesson 07 covers state notice laws, and lesson 17 pulls the monitoring rules into one framework (records, retention and workplace privacy). If the business pays a phone stipend, say in the policy that the stipend does not turn the phone into company property.

Lost devices and travel

A lost phone is a certainty in a firm of 100. The control that matters is speed of report. Set a rule that a lost device is reported within hours, to one phone number or channel that is staffed, and that a report triggers revocation of sessions, a remote wipe where the model allows it, and a password reset for anything saved on the device. Full-disk encryption turns a lost laptop from a data breach into a hardware loss in many cases, which also bears on the breach notice laws in lesson 11. Many state laws exempt encrypted data from notice, but the details differ and the key must not have been exposed. For travel, the home-user guidance in module 71 applies.

Physical security is access control

An attacker who can walk into the server closet does not need a stolen password. A thief who takes a laptop from a parked truck gets the files. Physical controls are old and dull, and they are cheap next to what they protect. The Safeguards Rule's access control element expressly includes "as appropriate, physical controls" (16 CFR 314.4(c)(1)).

Control	What it stops	Evidence to keep	Rough cost (author estimate)
Badge or key-fob doors for the office, with a list of holders	Walk-in access; the former employee with a key	Badge holder list reconciled with HR each quarter; badge deactivated on exit	A few hundred dollars per door for hardware, plus software fees
Visitor log and escort rule	Unaccompanied strangers	Log retained for a set period	Paper or a small subscription
Locked server closet or network cabinet	Casual tampering; plugging into a live port	Key or badge list; photo of lock	Low
Clean desk and screen lock	Shoulder surfing; unattended screens	Policy, plus spot checks	None
Locked cabinets for paper records	Theft of paper; snooping	Key holder list	Low
Cable locks or vehicle rules for laptops	Theft from cars and counters	Policy signed at hire	Low
Camera coverage of entrances and closets	Evidence after an incident; deterrence	Retention period and who can view	Hundreds to a few thousand dollars

Camera footage and badge logs are records about people. They show who was where and when, which makes them personal data that can be requested, subpoenaed and breached. Set a retention period (30 to 90 days is common for routine footage, an author rule of thumb, not a legal standard), limit who may view it, and write down what the footage may be used for. Biometric badge readers and fingerprint time clocks raise a different problem. Illinois's Biometric Information Privacy Act and similar laws set written policy and consent duties, and lesson 07 covers them. Choose a card or code where a biometric adds legal exposure and no extra security.

Discarded devices and media

Old laptops, copiers, phones and drives hold data after you stop using them. NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization, was finalized in September 2025 (the NIST record shows September 26, 2025) and supersedes Rev. 1 (December 2014) (NIST). Many older guides, including the standard text of earlier checklists, still cite Rev. 1. NIST describes media sanitization as making recovery of the target data impractical at a stated level of effort, matched to how sensitive the data is. Rev. 1 sorted methods into Clear, Purge and Destroy, and the Rev. 2 text still uses those three method names. Check the Rev. 2 text for how it defines each before you write them into a policy.

For a manager the procedure matters more than the vocabulary. Keep an inventory of devices that hold data. Assign a sanitization method by data sensitivity. Get a certificate of destruction or a wipe record from the vendor or the technician, and keep it with the asset record. Do not forget copier hard drives and phones traded in for credit. For customer information under the Safeguards Rule, the disposal procedure rule generally requires disposal no later than two years after the information was last used to serve the customer, with exceptions for business need, legal retention or infeasibility (16 CFR 314.4(c)(6)). Retention schedules, legal holds and the rest of the deletion story are in lesson 17.

Cost ranges and vendor questions

Item	Range	Label
Microsoft 365 Business Premium (includes identity, conditional access features, endpoint management)	$22.00 per user per month with Teams, billed yearly	Sourced in lesson 02 from Microsoft's page, October 2026; recheck before buying
Google Workspace with security keys and Context-Aware Access	Plan-dependent; check Google's current price page	Not verified for this lesson
Stand-alone identity provider (Okta-class tool) for firms on mixed systems	Roughly $2 to $10 per user per month	Rough planning range by the author; get quotes
Hardware security keys	Roughly $25 to $70 each; two per admin	Rough planning range by the author
Team password manager	Roughly $3 to $8 per user per month	Rough, same as lesson 02
Mobile device management for a firm of 100 phones and laptops	Often bundled with the licenses above; stand-alone roughly $3 to $10 per device per month	Rough planning range by the author
IT time to roll out SSO, MFA enforcement and conditional access for 150 users	Roughly 40 to 120 hours	Rough estimate; depends on the age of applications

Questions to ask your IT provider or vendor

• How many enabled accounts do we have, how many match a current person or a documented service, and how many are dormant for more than 45 days?
• What share of accounts, human and non-human, is covered by MFA today, and which method does each group use?
• Who holds administrator roles? Does each use a separate admin account, and how many are shared logins?
• Where are our two break-glass accounts, when were they last tested, and what alert fires when one signs in?
• If a leaver was disabled at 5 p.m., can you show that their sessions and tokens were revoked and when?
• Which applications are outside SSO, and who owns the risk for each?
• Do we use security defaults or written conditional access policies? May we see the policy list and the report-only results?
• Can personal phones reach company email without any control? What can the tool see and wipe on a personal phone?
• Who has a badge, and when was the list last compared with HR records?
• Where is the wipe or destruction record for the last ten retired devices?

Questions and answers

Is MFA by text message good enough?

It is better than a password alone, and CISA lists it as phishable and exposed to SIM swapping. NIST 800-63B-4 restricts phone-network codes for the federal systems it governs. Use an authenticator app with number matching as the floor and move administrators and payment approvers to security keys or passkeys. Keep text codes only for people who cannot use anything else, and log them as an exception.

Do we need SSO if we have only 40 people?

Not on day one, but the leaver benefit shows up at any size. If the main applications are Microsoft 365 or Google Workspace, you already have SSO for those, and adding the finance, CRM and project tools to the same sign-in costs little. Do it when the count of separate logins staff manage passes what a password manager can reasonably cover, or the first time a leaver kept access to a vendor site.

What is the cheapest strong step this quarter?

Two security keys for each administrator, plus a rule that admin accounts are separate from daily accounts. Nine admins and thirty keys cost about $1,500 on the planning figures above. It addresses the account an attacker wants most.

How often should we review access?

Quarterly for administrators, finance, payroll, customer data and external users, and yearly for low-risk systems. After a reorganization, review the affected teams within a month. Keep each signed review.

Can the company require employees to use their own phones?

You can make the use of a personal phone for work optional, and set conditions if the employee chooses it. If the job needs a phone, issue one. If you require personal devices, expense reimbursement rules may apply in some states (not verified for this lesson), and the employee's expectation of privacy on a device they own is higher. State the rules and the stipend in the written BYOD policy, and keep a company-owned option for anyone who declines.

Is a shared login ever acceptable?

Only when a tool forces it, such as a social media account or a legacy portal. Put the secret in the team password manager, restrict who can see it, log use, add MFA through a shared device the company controls, and reset it every time a user leaves. Write down the exception and review it yearly.

What about passkeys on personal phones used for work?

Passkeys that sync through a platform's credential manager are convenient and phishing-resistant, and NIST 800-63B-4 allows syncable authenticators below the top assurance level (AAL3 needs non-exportable keys). For administrators, prefer hardware keys that you own. For ordinary staff, synced passkeys are a reasonable gain over passwords, provided the cloud account that holds them is itself protected with strong MFA and recovery is controlled.

Does an insurance application ask about all this?

Yes, usually about MFA for email, remote access and administrator accounts, and about backups and endpoint protection. Answer from the measured numbers in your dashboard, and recheck the answer at renewal. Lesson 12 covers why a wrong answer on an application is a coverage risk.

Hard questions

Security keys cost money and staff lose them. Why not stay with app codes?

Because the app code is the step that criminals now phish. Keys are the single control CISA names as widely available and phishing-resistant. The answer to lost keys is a second key per person, a recovery process that checks identity through a person at the company, and a short lead time on replacements. The cost is a few dozen dollars per key against the cost of a taken-over administrator account, so for the small group where one account can empty a bank account or erase backups, the trade is easy. For the rest of the staff, app-based MFA with number matching is a sound floor until passkeys are in place.

Conditional access can lock the whole company out. Is the risk worth it?

The lockout risk is real, which is why Microsoft's guidance calls for two break-glass accounts, an exclusion group for them, report-only mode before enforcement and a test every 90 days. Run each new policy in report-only first, read the results, and then enforce. The alternative, no policy, leaves every stolen password working from any country on any device. A tested emergency path is cheaper than either outcome.

If we force MFA on contractors and vendors, will they walk away?

Some will complain. Offer them the least intrusive option, an authenticator app on their own phone, and limit their access to the one application they need. A contractor with a standing account that lacks MFA is the soft target in your tenant, and customers' security questionnaires often ask how third-party access is controlled. If a vendor refuses, record the risk acceptance with a name and a date, and consider whether that vendor should hold your data at all (lesson 09).

Is a BYOD program worth the legal and employee relations trouble?

It can be, if it is app-level and clearly bounded. A company that issues phones to everyone with data access removes most of the trouble but carries the cost and the lost-device exposure. A company that allows unmanaged personal phones to read sensitive mail takes on the most risk for the least savings. The honest comparison is the stipend against the cost of a managed phone, plus the cost of a single breach where an unmanaged device was the entry. Many firms land on company devices for finance and administration, app-protected personal phones for everyone else.

Our IT provider holds the only global admin account. Is that a problem?

Yes. It means the provider, and anyone who breaks into the provider, owns your company's identity. The tenant should be in your company's name, with at least two administrator accounts under your control, a break-glass account whose credential you hold, and the provider's access through named accounts that you can disable. If a contract ends badly, you must be able to lock the provider out the same day. Lesson 18 covers what to put in a managed service contract.

Are we required by law to do any of this?

Some of it, depending on who you are. The Safeguards Rule requires MFA for any individual accessing any information system for the businesses it covers (16 CFR 314.4(c)(5)), access controls including physical ones, logging, and disposal procedures. HIPAA's Security Rule has access control and workforce termination requirements for healthcare entities, which lesson 06 summarizes. For everyone else, no single statute names the controls in this lesson, and the standard that applies is "reasonable security" under state laws and the FTC Act, which regulators, courts and insurers read against sources like the NIST and CIS documents cited here. That is why the evidence in the reporting angle matters.

What we could not verify

• The CISA Zero Trust Maturity Model page fetched in October 2026 did not show the version date. The "version 2.0, April 2023" date comes from lesson 02. The pillar, capability and stage names come from Microsoft's summary of the model, and the CISA page confirms five pillars but did not name them in the text retrieved.
• The CIS Controls site did not list safeguard counts in the page retrieved. The safeguard titles and IG levels for Controls 5 and 6 come from CIS's Controls Assessment Specification site.
• The Rev. 2 PDF was checked for the Clear, Purge and Destroy method names, which it keeps. The detailed Rev. 2 procedures were not read. An older planning spec cited Rev. 1, which Rev. 2 supersedes.
• Google Workspace pricing was not confirmed. Google's administrator best-practices page says to keep at least two super admins, each held by a different person, and to enroll a spare security key.
• All cost ranges marked rough are author estimates. The 45-day dormant account period comes from CIS safeguard 5.3 (a benchmark, not a law). The 30 to 90 day footage retention period is a common practice, not a legal requirement.