If you have answered 'No' to question A7.14, please provide a list of your cloud services that do not provide any option for MFA.
What this question is really asking
This is an auto-fail question if answered incorrectly. Only list services where MFA is genuinely technically unavailable — that is, where the product does not offer MFA as a feature at all. Services that have MFA available but not yet enabled are not in this list — those are simply a fail. Assessors will review any listed service carefully.
What satisfies this requirement
A list is requiredList all in-scope cloud services with no MFA option. AUTOMATIC FAIL if a cloud service listed here actually does have MFA available. Reference Cloud Services MFA list for verification.
What to prepare before your assessor visit
Be very careful here — this is an auto-fail question if answered incorrectly. This list is only for services where MFA is technically unavailable as a feature, meaning the product does not offer it at all. Services where MFA is available but simply not yet enabled do not belong here — those are A7.16 or A7.17 failures. Assessors will verify every service you list: if MFA is available for a listed service, your assessment will fail on this question.
How this question sits across CE versions
Related policy templates
Getting certified means having documentation to back it up. These policy templates cover the controls this question tests.
Does your organisation meet this requirement?
Answer 30 plain-English questions and find out exactly where you stand across all 5 Cyber Essentials control areas — with a prioritised list of what to fix first.