If I'm not mistaken, what Danny is trying to say is that since HR.my contains information of individual that identifies the individual, access to the employee / employer portal must be strengthened with an added layer of authentication i.e. MFA / 2FA to prevent incidences of someone's personal information being disclosed because they used a weak password, leaked password or even just access without their knowledge.
