Identity and access
- Observation
- Unexpected MFA requests or unusual changes in a supplier’s access activity.
- Verification
- Check authorized activity, scheduled changes, and available logs.
- Decision to prepare
- Consider additional controls or temporary restrictions with the service owner.