MFA should be mandatory. Furthermore, MFA token generator should have a biometric component so only that person can use it. Heart P-QRS-T wave is 98% unique to each person.