Mandatory Multi-Factor Authentication

Effective Date: September 22, 2025

Approved by:

• David Kohler
• Chris Peppler
• Nick Banta

!!! info “Mandatory MFA Policy”

The official Approved Google Document for this policy can be found <a href="https://docs.google.com/document/d/1fHpL5oBhbWCjJI2EnX9pLXWDGSDqiG6fmIiiHe-JTXQ/edit?usp=sharing" target="_blank">here</a>.

To: All Product Teams Utilizing Trimble ID (TID)

Purpose

This document formally mandates the implementation of Multi-Factor Authentication (MFA) for all customer accounts accessing products integrated with Trimble ID (TID). This measure is critical to enhancing the security of our customers and their data and proactively preventing account takeovers and subsequent security breaches.

Rationale

Multi-Factor Authentication is the most effective control available to prevent unauthorized access to customer accounts. We have observed an increasing trend of customer accounts being compromised, leading to attackers gaining access to our products. Relying solely on incident response and other controls after a breach is insufficient to protect our customers effectively. Our commitment to customer protection necessitates this proactive and fundamental security measure.

Mandate

Effective March 31, 2026, all Trimble ID (TID) native users will be required to utilize Multi-Factor Authentication to access our hosted products.

Implementation Details

Baseline Configuration

The Cyber team is actively collaborating with the TID engineering team to develop a simple and user-friendly MFA implementation. This will primarily be an email-based one-time passcode (OTP) system, which will serve as the baseline configuration for all TID-integrated accounts.

Progressive Security Enrollment Enhancements

TID will provide users an enhanced customer experience with progressive security enrollment prompts to enable stronger MFA methods for their account, like passkeys or authentication applications.

Product Team Responsibilities

All product teams currently utilizing TID must ensure their products are prepared for and fully support this MFA enforcement.

Teams should work closely with the TID engineering team to understand the upcoming MFA implementation and any necessary product-side adjustments.

Support and Assessment

The Cyber team is available to assist product teams in assessing their existing MFA implementations (if any) to ensure they meet the spirit and letter of this requirement.

For any TID-integrated products that may have unique considerations or require specific support, please contact the Cyber team immediately.

Timeline:

Enforcement of MFA for all TID users will begin in early 2026. The TID engineering team, in coordination with the Cyber team, will provide specific communication regarding the exact rollout schedule and user experience.

Compliance

Compliance with this mandate is obligatory for all products leveraging Trimble ID. Failure to implement and enforce MFA for customer accounts will be considered a significant security vulnerability and will require immediate remediation.

We appreciate your cooperation in implementing this critical security enhancement to protect our customers.

Sincerely,

The Cyber Team