It's nearly impossible to talk about security in government orgs without extreme bike shedding regarding password length, changes and special characters. It's

It's nearly impossible to talk about security in government orgs without extreme bike shedding regarding password length, changes and special characters. It's not only about security - we have to factor out usability to prevent yellow stickers with "hard passwords". 2FA gives both usability and security and easy detection of dictionary attack against system - it could allow for even deliberately leaking passwords and then monitoring honeypots.