When should an organization implement two-factor authentication (2FA) for remote access to its network resources?