A security administrator at a financial services firm wants to reduce the risk of compromised credentials for a small group of privileged users who authenticate with username and password. The firm does not use an identity provider for SSO. Management asks for the fastest way to add a second authentication factor for these specific users without changing how the rest of the organization logs in. What should the administrator do?