Avoid treating Multi-factor authentication as a one-time purchase or checklist item. Tie it to the intended outcome—requires independent authentication factors so a stolen password alone is insufficient—assign accountability, measure coverage and effectiveness, review exceptions, and update it when threats, systems or business requirements change.

CIS Critical Security Controls v8: https://www.cisecurity.org/controls/v8