Mechanisms exist to securely manage authenticators for users and devices.
Does the organization securely manage authenticators for users and devices?