Is Two-Factor-Authentication (2FA) compulsory?