Ensure only hardware MFA is enabled for the root account.