CAPA-024In reviewMajor NC
Enforce MFA on local privileged console access
Owner TOTom OkaforDue 2026-11-15Raised from FND-031 · AUD-2026-03
- Containment
- Root cause
- 3Action plan
- 4Implementation
- 5Effectiveness check
- 6Closed
Pending your approval · action plan, step 2 of 2 · due Oct 13Approving moves the CAPA to Implementation.
Problem
Internal audit sampled 12 servers in the CUI enclave; 4 legacy CAD servers allow local privileged console logon with password only.
Root cause · 5 Whys
Legacy servers excluded from the Duo rollout because of an unsupported OS build.
Relationships7 link types
Originates from1:11
FND-031MFA not enforced for local privileged access on 4 of 12 serversOpen
Shows on the other side as “corrected by CAPA-024”
Treats riskN:11
RSK-039Privileged admin accounts lack MFA on local console accessOverdue
Shows on the other side as “treated by CAPA-024”
CorrectsN:N1
3.5.3Use multifactor authentication for local and network accessNot met
Shows on the other side as “corrected by CAPA-024”
Corrects objectiveN:N1
3.5.3[b]MFA is implemented for local access to privileged accounts.Not met
Shows on the other side as “corrected by CAPA-024”
Verified byN:N2
EVD-0311Duo MFA enrollment report — Sep 2026.pdfVerified
EVD-0318Console login audit — 30-day sample.csvIn review
Shows on the other side as “verifies CAPA-024”
Updates documentN:N2
POL-004Access Control PolicyIn review
PRC-011User Access Provisioning ProcedurePublished
Shows on the other side as “updated by CAPA-024”
Applies to assetN:N2
AST-0112eng-fs-01Active
AST-0119Legacy CAD servers (4)Active
Shows on the other side as “covered by CAPA-024”
You are the final approver for this action plan.