Problem:

Currently, two-factor authentication (2FA) appears to be optional for advisors and firm staff. Since the portal contains highly sensitive client data (tax returns, SSNs, financial documents, invoices, etc.), optional 2FA creates a security risk if users choose not to enable it.

Request / Desired Outcome:

Require mandatory 2FA enrollment for all advisor accounts and firm staff accounts (and ideally any user with access to sensitive client information).

Why This Matters:

Making 2FA optional increases the likelihood of:

Unauthorized access if login credentials are compromised

Increased risk of sensitive data exposure

Security concerns from partner firms and enterprise-level clients

Impact

Improves overall platform security and client trust

Aligns with common best practices for handling sensitive financial/tax data

Reduces risk for both advisors and Harness

Source / Feedback

This request is based on partner feedback from BAAP, recommending that 2FA be mandatory for all advisors and staff for security purposes.