When conducting interviews to qualitatively measure MFA adoption and identify potential issues, it’s essential to tailor questions to the specific roles and responsibilities of the interviewees. Below are two lists of questions: one for senior management and one for individual contributor employees.
Interview Questions for Senior Management
1. Understanding of MFA Mandate:
- How did you perceive the decision to mandate MFA for all employees?
- What was your role in communicating and enforcing the MFA policy?
- How do you assess the importance of MFA in the context of our overall cybersecurity strategy?
2. Awareness and Communication:
- Do you believe the MFA requirement was effectively communicated to all levels of the organization?
- Were there any follow-up communications or reinforcements after the initial email and policy update?
- How frequently is cybersecurity training, including MFA, discussed in senior management meetings?
3. Monitoring and Compliance:
- How do you monitor compliance with cybersecurity policies, including MFA adoption?
- Have you observed any trends in MFA adoption across different departments or teams?
- What metrics or reports do you use to track MFA adoption, and how are they utilized?
4. Challenges and Barriers:
- What challenges have you encountered or heard about regarding MFA adoption among employees?
- Are there any specific departments or roles where MFA adoption has been particularly problematic?
- How do you handle feedback or resistance to MFA implementation from other senior leaders or teams?
5. Improvement and Support:
- What resources or support have been made available to employees to assist with MFA adoption?
- Have you considered any initiatives to increase MFA adoption, such as incentives or further training?
- What steps do you think can be taken to improve MFA compliance within the organization?
6. Future Outlook:
- How do you see the role of MFA evolving in our cybersecurity strategy over the next few years?
- What other security measures are being considered to complement or enhance MFA?
Interview Questions for Individual Contributor Employees
1. Awareness and Understanding:
- Can you describe your understanding of why MFA was mandated by the company?
- How did you first learn about the MFA requirement? Was it through the email, policy update, or another source?
- How clear were the instructions on how to enable MFA on the company’s cloud systems?
2. Adoption and Usage:
- Have you enabled MFA on all required systems? If not, can you explain why?
- How often do you encounter MFA prompts in your daily work routine, and how do you feel about it?
- Did you face any difficulties or confusion while setting up MFA on your devices?
3. Challenges and Concerns:
- What challenges, if any, did you encounter when trying to enable MFA?
- Are there specific systems or applications where MFA is more cumbersome to use?
- Have you experienced any disruptions or inconveniences due to MFA that impacted your work?
4. Support and Resources:
- Were the resources provided (e.g., instructions, help desk support) sufficient to help you enable and use MFA?
- Did you seek help from IT or colleagues to enable MFA? If so, how was that experience?
- What additional support or resources would make it easier for you to comply with the MFA requirement?
5. Perception and Motivation:
- How do you perceive the value of MFA in protecting company assets and data?
- What motivates you to comply with cybersecurity policies, including MFA, or what demotivates you?
- Do you feel that the company values your input on cybersecurity matters, such as MFA implementation?
6. Suggestions for Improvement:
- What would make the process of adopting MFA easier for you and your colleagues?
- Are there any suggestions you have for the company to increase MFA adoption across the board?
- How can the company better communicate the importance of MFA and other security measures to all employees?
These questions will help identify both the level of MFA adoption and any obstacles that employees face, allowing the organization to refine its cybersecurity strategy and improve compliance.
We love to share our knowledge on current technologies. Our motto is ‘Do our best so that we can’t blame ourselves for anything“.