Provide (do not require) CAC access, without the dual authentication requirements. A significantly large portion of the user base, work in secure environments, without LAN line or Cell phone access. Some of us are grown up and can use a CAC on personal computers. Plus scrap the 18 hour session time out. It is just a head ache that actually reduces security because people are using the alternative number sign in, and some rando is hitting the pound sign, proving nothing.