The Exceptions That Break MFA Start in the Boardroom
IT Security Guru, Thursday, November 5th, 2026
Executive requests to skip MFA create a governance gap that NIS2 makes harder to ignore, so exceptions need a formal, documented process.
IT Security Guru argues that MFA rollouts often fail when senior leaders ask to be exempted, leaving a policy on paper but weaker identity protection in practice.
Under NIS2, Article 21 requires MFA where appropriate and Article 20 makes management bodies approve and oversee cybersecurity measures, so leaders seeking exemptions from controls they approved create a governance problem.
The piece separates genuine constraints, such as legacy applications or technical accounts, from exemptions based on inconvenience or job title, noting executives are frequent phishing targets.
It recommends a documented exception process recording affected systems, the reason, the risk, mitigations, who accepted it and a review date, with no exemption for senior management.