...
The right "can show plaintext cc" in the roles allows the user to exectue the secured process to display credit card details in plain text.
The right "can show plaintext cc" needs an addtional signed agreement/designation/document.
Those users which are having the access right active will be forced within the first login starting form the 27th September to setup 2-factor-authentication, ohterwise the user is not able to login.
...