Passwords and Multifactor Authentication for a Small Business: A Practical Setup
Note: Some future links on this site may be affiliate links. We never claim hands-on testing; guides are researched from the public sources listed in each article.
How we wrote this: A guide based on the Cybersecurity and Infrastructure Security Agency's (CISA) Secure Our World guidance and a NIST small-business fact sheet (linked below). We have not tested or compared password managers or security keys, and we don't recommend specific products.
Most small-business account takeovers don't need clever hacking. They start with a reused password or a phished login. Two habits close most of that gap: unique passwords stored in a password manager, and multifactor authentication (MFA) on the accounts that matter.
Step 1: Strong passwords, the CISA way
CISA's Use Strong Passwords page sets three rules. A strong password is:
- Long: at least 16 characters.
- Random: either a random mix of letters, numbers and symbols, or a passphrase of 4 to 7 unrelated words.
- Unique: a different password for every account.
Nobody can remember dozens of those, which is why CISA recommends a password manager. It generates, stores and fills in passwords, and flags weak or reused ones. You then remember just one strong passphrase for the manager itself. CISA notes that some password managers are free, such as those built into web browsers, and others are paid.
Step 2: Turn on MFA, starting with the riskiest accounts
CISA's Require Multifactor Authentication page for businesses says strong passwords alone are no longer enough. MFA requires two or more ways to verify who's signing in. CISA's steps:
- Require MFA wherever possible: email, file storage and remote access. Start with admin accounts and people who handle sensitive data.
- Use the strongest option available. CISA ranks methods from most to least secure:
| Method | CISA's notes |
|---|---|
| Physical security key | Best protection against phishing; plugs in or taps |
| Authenticator app with number matching | You type the number shown on the login screen |
| Authenticator app with one-time code | New code every 30 seconds |
| Biometrics | Usually device-specific; best combined with another method |
| Text or email code | Most familiar but weakest; use only if nothing stronger is offered |
- Educate your team on why it matters, and encourage MFA on personal accounts too.
Text-message codes are weaker partly because phone numbers can be hijacked. See our porting guide for how to lock your number.
A one-afternoon setup plan
- List your critical accounts. Typically email, bank, payroll, accounting, domain registrar and DNS, website hosting, cloud storage, social media, and your phone provider. Email comes first, because it can reset almost everything else.
- Pick a password manager for the team and set a long passphrase for it. Turn on MFA for the manager itself.
- Change the critical passwords to long, random, unique ones generated by the manager.
- Turn on MFA for each critical account, using a security key or authenticator app where offered.
- Save recovery codes somewhere safe and offline, such as printed and locked away. Losing your only second factor can lock you out.
- Remove old access. Delete accounts of former staff and contractors, and change any shared passwords they knew.
- Repeat for the next tier of accounts over the following weeks.
When something goes wrong
NIST's small-business phishing fact sheet advises that if you think a login was phished, you should change the password right away (and anywhere else it was reused), contact your bank's fraud department if a financial account was involved, and follow your incident plan. Our guide to business email compromise covers the payment-redirect scams that often follow a stolen email login.