Insight #1
There will always be a balance in the psychological acceptability of any security controls put on users. This is especially important when developing a data loss prevention (DLP) strategy for your organization.
Insight #2
How are you managing your root AWS accounts? Shared account phone numbers? Regionally dispersed hardware MFA? There are many best ways to do this, but do what is best for your organization and protect these credentials more than anything else.
Insight #3
It’s time to remind you to set up MFA. It is the single easiest thing to implement to protect your accounts from compromise.