Do you use a bastion server? Is there auditing? Who can connect to production? MPA/MFA required?