When selecting authentication methods for an organization, which factors should be considered?

• A. Usability, security, risk profile, MFA availability, regulatory requirements, and user base.
• B. Only speed and cost of implementation.
• C. Only password length and complexity.
• D. Only vendor support for hardware tokens.

Answer: (B)

Choosing authentication methods means balancing how easy it is for people to sign in with how strong the protection is, while also meeting regulatory and organizational needs. You want to consider usability so people aren’t tempted to bypass controls, because a method that’s too painful to use will lead to insecure workarounds. You also weigh security to ensure the method provides adequate protection against common threats like phishing, credential stuffing, or device loss. The risk profile of the organization matters too: higher-risk environments may require stronger, multi-factor or phishing-resistant options, while lower-risk contexts might tolerate simpler approaches. Availability of MFA options matters because you need practical, deployable methods that your users can actually use—whether push notifications, hardware tokens, or biometric factors. Regulatory requirements shape what controls are required or prohibited, ensuring compliance with industry standards and laws. Finally, the user base—differences in devices, locations, accessibility needs, and offline requirements—affects which methods will work reliably for everyone. Focusing only on speed and cost misses these critical dimensions, and focusing narrowly on password length or vendor hardware support ignores security, compliance, and real-world usability. The best approach is to evaluate all of these factors together to select an authentication method that is secure, usable, compliant, and feasible for the organization.