There is a similar question here: Decision making for MFA frequency per organization but unfortunately no answer.