Interesting - they were added to WMF-NDA, but none of the acl*security groups. I've gone ahead and added them to acl*security_management, so they should be able to see all current security issues tracked in Phab (some of these are public if they're low-risk, etc.)

In T367205#9938963, @Aklapper wrote:

Per Security's SOP, "Set up Two-Factor Authentication for your Phabricator account under Settings → Authentication → Multi-Factor Auth" is required.
This has not happened thus reopening this ticket.

Hmm, I assumed since they already had WMF-NDA, they had Phab 2fa enabled. I won't make that assumption again. @CDanis - as the creator of this task, would you be able to relay this request to @SDeckelmann-WMF?

In T367205#9940099, @sbassett wrote:

Hmm, I assumed since they already had WMF-NDA, they had Phab 2fa enabled.

Ah - that would require improved onboarding processes. See also related {T304792}.

Hey! I get the emails, so no relaying required :)

And, done.