Every account can now turn on two-step verification with Google Authenticator, 1Password, Microsoft Authenticator or any TOTP app: in your account, under Useful Links, Two-Factor Authentication. The reason is the connected social accounts: with a password alone, whoever steals it posts on every network of the organization. The dashboard reminds anyone who has not turned it on, and on organizations that publish the Publish, Drafts and Accounts pages require it before going on. Owners see on the Team page who has it on and who does not, with a switch "Require two-step verification to publish" that is on by default; the dashboard tells them how many teammates still have to turn it on.