All employees Mail and Cloud accounts require strong password and 2FA with U2F physical security keys.
SSO is used whenever possible for any other service we use and 2FA is mandatory.
All employees are provided with a password manager account to help them generate secure and unique passwords as well as sharing secrets internally. SSO is used to connect to their password manager.
All employees' laptop’s disk are encrypted.