PROJECT 004 / FICTIONAL EVIDENCE EXAMPLE
MFA Coverage Verification
- Scenario
- Fictional marketing company
- Requirement
- REQ-007
- Control
- CTL-007
- Assessment date
- October 28, 2026
Requirement and scope
The company requires multifactor authentication for human users who sign in to the advertising accounts included in this assessment.
A reviewer would need to identify the accounts in scope, determine who can access them, and review any exceptions before making a claim about coverage.
Evidence record
- Evidence ID
- EV-007
- Title
- Advertising-account MFA
- Reference
- SYNTHETIC-REFERENCE-007
- Recorded review status
- Reviewed
- Recorded review date
- October 20, 2026
This is a fictional record. Its reference is an example identifier, not a link to a real document or proof that MFA is enabled.
Reviewer’s notes
Before supporting an MFA coverage claim, the reviewer would examine whether the evidence:
- Identifies the advertising accounts and users included in the review.
- Shows the MFA configuration for those accounts.
- Documents any exceptions and how they are managed.
- Is current enough for the purpose of the assessment.
The fictional sample records a review status and date, but it does not contain actual configuration evidence.
Assessment progression
Original assessment: CTL-007 is recorded as implemented, but no evidence is linked to it. REQ-007 is marked Needs work.
Reassessment demonstration: EV-007 is linked to CTL-007. The tool’s recorded metadata checks then mark REQ-007 as a Supported draft.
A supported draft remains subject to human review. The tool does not open the evidence reference or verify MFA settings.