Professional Behaviour
Integrity and Due Care
Professional Competence
Confidentiality
Objectivity
As you answer the questions consider if a competent and objective outsider may be needed by your organization to properly assess the risks and aid with the policy and procedural changes required.
As we apply the five fundamental principles of Ethics it will become clear to some that using password managers and MFA is an ethical requirement.
For others they do not see a password manager and MFA as an ethical requirement. Opinions on what is ethical behaviour and was is not is often diverse. If your organization is not using password managers and MFA hopefully this will start the conversation.