Multi-factor authentication is enforced for enrolled accounts. Min 12 chars · upper/lower/digit/symbol · 90-day rotation · no reuse of last 5