2FA Method Selection SOP

2FA Method Selection SOP
Choosing the second factor for admin logins. Match method to threat.

— Use TOTP (authenticator app) as the floor: phishable but kills credential-stuffing and password reuse.
— Use WebAuthn/passkeys (hardware key, platform authenticator) for anyone with full admin: origin-bound, immune to phishing and reverse proxies like Evilginx.
— Never default to SMS: SIM-swap and SS7 interception make it the weakest tier. Allow only as last-resort recovery, not primary.
— Verify TOTP secret isn't logged or emailed in plaintext during setup.
— Enforce: require WebAuthn for the administrator role, allow TOTP for editors, block SMS for both.

Run this every time you enroll a privileged account.