MFA, across the board, on all services, is a must.

Otherwise accounts are at a major risk of compromise since people tend to use the same password across systems and services, which are eventually hacked.