CISA Cloud Security Technical Reference Architecture v2.0 5.2b: Manage identities, credentials and access across the life cycle with phishing-resistant MFA and granular privileged access

What does 5.2b require?

Identity, credential and access controls are integrated across the whole identity life cycle with continuous monitoring and analysis so that account activity and behaviour patterns reveal compromise, services automatically inherit the right configurations, and overly permissive policies and unrestricted code execution privileges are eliminated; on-premises controls are kept current and consistent with the providers', phishing-resistant multi-factor authentication is enabled, privileged accounts get more granular access levels, and analytics, auditing and reporting support compliance, with the FICAM playbooks as reference.