Oredra Security Library
Identity & access security questionnaire answers
MFA, user access, least privilege, and periodic access review questions.
Identity & access
Questions customers commonly ask.
Identity & access
Do you require multi-factor authentication (MFA)?
The reviewer is usually asking whether access requires more than a password and, just as importantly, where that requirement applies. Do not answer “yes” simply because your software supports MFA. Confirm that your company actually requires it for the users and systems in scope.
Understand this questionIdentity & access
How do you provision user access?
Explain how a person receives access, who approves it, and how the access level is chosen. A written procedure is useful, but do not claim a formal approval workflow if access is actually granted informally.
Understand this questionIdentity & access
How do you remove access when an employee or contractor leaves?
Describe who triggers access removal, who performs it, which account types are covered, and any timing you can actually support. Avoid promising immediate or same-day removal unless that is a verified company practice.
Understand this questionIdentity & access
Do you follow the principle of least privilege?
Least privilege generally means limiting access to what a person needs for their responsibilities. Before answering “yes,” confirm how permissions are actually assigned and whether broad administrator access or shared accounts create exceptions.
Understand this questionIdentity & access
Do you conduct periodic user access reviews?
A periodic access review is a deliberate check that existing access is still appropriate. Routine account administration is not automatically a periodic review. Answer based on whether your company actually performs a recurring review and can describe its scope and frequency.
Understand this questionNot sure what your company can answer?
Check your questionnaire readiness in about three minutes.
See which common areas are clear, scattered, uncertain, or simply not something your company does today. It is not a compliance score.
Take the free readiness check