Secure by Design: A Guide for Manufacturers (CISA) P2-PD1: Establish and publish internal security controls

Because cloud and SaaS providers become targets once customer data moves to them, they should publish statistics on their own internal controls, such as the deployment of phishing-resistant MFA like FIDO; ideally no staff member can reach customer or other sensitive data without it.