A security analyst just discovered that developers have access to production systems that are used for deployment and troubleshooting. One developer, who recently left company, abused this access to obtain sensitive information. Which of the following is the BEST account management strategy to prevent this from reoccurring?

1. Perform an account review and ensure least privilege is being followed for production access
2. Implement multifactor authentication for accessing production systems
3. Configure jump boxes and prevent access to production from any other system
4. Set up time-of-day restrictions that prevent access to production systems during business hours
5. Modify the AUP to prohibit developers from accessing production systems