We're a small UK startup building a small service that allows certain special people (e.g. journalists) to access non-public court information.
This information includes a ton of private and sensitive information that cannot just be shared online. From relatively minor things like the name and address of someone accused of doing 31mph in a 30mph zone. But on the other end it also includes e.g. the name, address, age, relatives etc of rape victims, or 12 year old children who have allegedly committed a crime, or children who are potential victims of rape and sexual abuse (or adults who were). This information about protected victims or defendants (which covers sexual crimes and defendants under 18) is illegal to publish, and even illegal to share with the general public (the specifics, the fact that an anonymous case exists in the courts is not illegal to publish).
Anyone who can access this system should be vetted so that they know these laws (e.g. journalists, lawyers, etc), and then it will be their responsibility to use the information legally, and they will hold the liability.
Naturally we want to enforce 2FA on logins. But my question here is whether it's safe to allow devices to be added and remembered for the 2FA? For example Google accounts allow you to tick a box that says this service will be remembered and skip 2FA for a certain time period (1 month iirc).
From the user design point of view it would obviously be better if users were not prompted with a 2FA screen every time they logged in as this delays people and can be frustrating.
In terms of security, is there much of a risk in allowing devices to be remembered for e.g. a month?
Is there anything relating to this with security standards? We will likely have to pass/implement security standards etc before launch, will this effect any of these? E.g. I see ISO 270001 mentioned for similar things, will having the ability to remember 2FA effect this?