What is the current functionality of the system with respect to use of complex passwords and two-factor user authentication?

If not already implemented, it has been recommended that this be considered as a way to enforce use of individual user accounts (i.e. deter sharing of user accounts), and significantly improve data security.

Does CPIMS+ include two factor authentication ? If not, is it possible to add this feature?

Primero/CPIMS+ requires a complex password (Password must be at least 8 characters and include both letters and numbers). We currently use 2 factor for MRMIMS+, not yet for CPIMS+. For 2 factor: UNICEF CO could get their Innovation or ICTD colleagues to look into it. There are many ways to do 2 factor, and not all are equal (or effective). This will be addressed in Primero V2 (dev work to start in Q1 2019).