The system _MUST_ be configured such that, when the su command is used, multifactor authentication is enforced. All users _MUST_ go through multifactor authentication to prevent unauthenticated access and potential compromise to the system.