Topic starter
13/10/2026 1:21 pm
TL;DR: Unosecur says 304 of 1,993 failed checks, about 15%, involved admin-level accounts without MFA, making ISO/IEC 27002 Control 5.17 the most-violated norm in its half-year cloud dataset. The issue is not just authentication weakness: privileged access that can still be reached with a password alone creates audit exposure, breach risk, and avoidable remediation.
Editorial analysis by NHI Mgmt Group, based on content published by Unosecur: “ISO 27002 - 5.17 : Why MFA for Cloud Admins Can’t Wait”.
By the numbers:
- 304, or about 15%, of the 1,993 failed checks involved admin-level accounts without MFA.
- 169 organizations ran the free risk assessment between 1 January and 30 June 2025.
Key questions
Q: What breaks when privileged users still rely on phishable MFA?
A: Phishable MFA fails when the attacker can trick a user into revealing or approving the second factor, which leaves privileged access exposed even though MFA is technically in place.
Q: Why does ISO 27002 5.17 matter more for admin roles than for ordinary users?
A: Admin roles can change systems, data, and security settings, so a weak sign-in path has a much larger blast radius.
A: MFA is working when high-risk accounts cannot authenticate with password-only access, exceptions are rare and approved, and logs show consistent challenge enforcement for VPN, SSO, and admin logins.
Practitioner guidance
- Enforce MFA on every privileged role Require multi-factor authentication for all admin, owner, and project-wide roles, with no standing password-only path into cloud consoles or sensitive systems.
- Retire or bound break-glass accounts Convert emergency access accounts to tightly controlled just-in-time elevation or remove them where they no longer serve a documented recovery purpose.
- Track privileged MFA coverage as a control KPI Monitor the number of admin accounts without MFA until the metric reaches zero, and review exceptions as formal risk decisions rather than operational shortcuts.
Bottom line: The article argues that the cloud MFA problem is concentrated in privileged accounts, where a password-only path remains the most dangerous failure mode.
What's in the full article
Unosecur's full analysis covers the operational detail this post intentionally leaves for the source:
- The half-year cloud-compliance dataset behind the control failure analysis
- The breakdown of ISO 27001, PCI DSS v4, and SOC 2 clause mappings used in the assessment
- The article's guidance on break-glass account handling and session-control remediation
- The control-by-control discussion of how organisations can evidence privileged MFA for audits
👉 Read Unosecur's analysis of ISO 27002 5.17 and privileged MFA failures in cloud teams →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
13/10/2026 1:22 pm
ISO 27002 5.17 is a privileged-access control, not a generic login control: The article is right to focus on admin accounts because that is where authentication weakness turns into governance failure. A workforce-wide MFA policy can still leave the highest-risk identities exposed if privileged roles are treated as exceptions. The practical implication is that compliance teams must test the control at the privilege boundary, not at the perimeter.
A few things that frame the scale:
- 82% of breaches involved data stored in the cloud, according to IBM (2024).
A question worth separating out:
Q: What should organisations do when break-glass accounts still exist?
A: Treat break-glass accounts as temporary recovery mechanisms, not standing alternatives to normal privileged authentication. Each account should be tightly scoped, monitored, and reviewed for whether just-in-time elevation can replace it without reducing recovery capability.
👉 Read our full editorial: ISO 27002 5.17 exposes the MFA gap in cloud privileged access