It's cybersecurity departments that mandate these policies. In my organization a lot of these people come by way of the U.S. Air Force and NSA. They literally h

It's cybersecurity departments that mandate these policies. In my organization a lot of these people come by way of the U.S. Air Force and NSA. They literally have seats at the table in the White House for DHS (Department of Homeland Security) meetings. Can you guess for what the advocate? Yep - SMS 2FA! Now imagine you're the CEO of my company (a Fortune 200 company), a company that's responsible for infrastructure that's been deemed vital to the security of the United States. Who do you think the CEO is going to listen to, me or the Air Force guys and guys hailing from American's top three letter security agencies? Now, if that's what our CEO is doing then what do you think your CEO is doing? That's right - they're looking at what we're doing. They know we have our personnel engaged in meetings at the White House. They know we're managing nationally critical infrastructure. They know how we're securing our customer-facing applications - and that's SMS 2FA. My advice is to keep your mouth shut unless you're a recognized security expert. You're just spending political capital for naught.