Nine Months Without MFA: Who Signs?
Northline Payments processes $400M in annual card volume for a mid-size retailer. Its new gateway vendor returned a SOC 2 Type 2 with two exceptions: the administrative portal has no MFA, and privileged access reviews happen annually rather than quarterly. The vendor says MFA will not ship until Q3, nine months out. The retailer's compensating controls are source-IP allowlisting on the vendor portal and weekly log review by a single analyst. The business owner for payments wants to sign a risk acceptance so the contract can close this quarter, arguing that nothing has gone wrong so far. The risk register scores the relationship as high inherent risk.
1. Who should formally accept this risk, and what must the acceptance document contain?
Read the worked answer
The business owner for payments accepts, not the CISO. The CISO assesses and advises; accountability for the business consequence of a vendor compromise sits with the person who owns the revenue and the relationship. A CISO who signs creates the false impression that security owns the outcome, and it removes the incentive for the business to weigh the trade-off.
The acceptance must be explicit and falsifiable:
- The specific risk being accepted (credential compromise of a privileged vendor portal leading to cardholder data exposure), not a generic high rating.
- The residual risk estimate after the two compensating controls, with the reasoning stated.
- The acceptance period - expire it at the MFA ship date or earlier.
- Named owner, review date, and the milestones that void the acceptance if missed.
- The escalation threshold: what situation forces re-review (e.g., any anomalous portal login, or Q3 slipping).
If the residual risk exceeds the delegated authority in the risk appetite statement, the acceptance must go up to the risk committee regardless of who wants the contract closed.
2. How should the CISO judge whether the compensating controls actually justify a temporary acceptance?
Read the worked answer
Test the controls against the specific threat rather than counting them. Two controls in name can be near-zero in effect.
- IP allowlisting only bounds the attack surface if the allowlisted ranges are narrow, are not shared office egress ranges, and cannot be reached by a phishing-driven session from an allowed network. If a compromised analyst laptop sits inside the allowed range, the control does nothing against the most likely attack path.
- Weekly log review by one analyst is detective, after-the-fact, and capacity-fragile. Ask: what is the mean time to review, what happens when the analyst is on leave, and would the review actually surface a new privileged login from an unexpected source? If the answer is unclear, the control is aspirational.
Then reason about exposure: nine months, $400M volume, and an internet-facing privileged portal with single-factor authentication is a long dwell window for a well-understood attack. A defensible position is conditional, time-bound acceptance plus additional monitoring the retailer controls - e.g., alerting on any portal login outside the vendor's normal pattern, and a quarterly attestation from the vendor - not acceptance on the strength of the two existing controls.
3. Mid-quarter, the business owner says he will close the contract with or without a signed acceptance. What is the CISO's course of action?
Read the worked answer
The CISO cannot block a commercial decision, but must not let it proceed unnarrated. Three steps, in order:
- Document the advice in writing - the assessment, the recommended conditions, and the fact that acceptance was offered and declined. This is not protectionism; the risk committee cannot govern a risk it never sees.
- Escalate by exception to the enterprise risk committee (or the CFO if that is the delegated body), framing it as an unaccepted risk above appetite rather than a dispute with a colleague. Include the specific exposure and the cheapest conditions that would make it tolerable.
- Apply the controls within reach - enhanced monitoring of the portal, logging retention, and a security schedule attached at the first contract amendment - so the organisation is not relying solely on hope.
The failure mode to avoid is quiet capitulation: risk silently absorbed without a record is how the same exposure recurs across every vendor in the portfolio.