NCSC Control Pillar 3 – Identity & Access Management (IAM)

1. Mandatory MFA Across All Cloud Apps: 100% enforcement across Microsoft 365, Google Workspace, AWS, and remote VPN portals.

2. Phishing-Resistant Authentication: Transition from SMS push codes to Number-Matching or FIDO2 hardware keys.

3. Offboarding SLA (< 60 Mins): Automated revocation of SaaS tokens and Active Directory / Entra ID accounts upon HR offboarding notice.