This option sets pam "control". If you want to have multi factor authentication, use "required". If you want to use the PKCS#11 device instead of the regular password, use "sufficient".
Read pam.conf(5) for better understanding of this option.
Declarations
Type
one of "required", "requisite", "sufficient", "optional"Default
"sufficient"