Mechanisms exist to protect authenticators commensurate with the sensitivity of the information to which use of the authenticator permits access.
Does the organization protect authenticators commensurate with the sensitivity of the information to which use of the authenticator permits access?