The risk of noncompliance with the MFA requirements of the Cybersecurity Regulations is significant, as NYDFS noted in the Industry Letter that MFA will be "a focus of [NYDFS's] cybersecurity supervisory and enforcement work." Notably, at least two cybersecurity enforcement actions resolved by NYDFS in the past year involved companies that "were required to implement MFA but had not fully done so and that failed to prevent unauthorized access to their nonpublic information." Moreover, NYDFS noted that it "is also increasing its review of MFA during examinations, with a particular emphasis on probing for the common MFA failures[.]"