Every account signs in with a password and a 6-digit code from an authenticator app. If you have lost your device, ask an administrator to reset it — nobody else can.
Authorized personnel only. Activity is logged (PSA 230 audit trail).