MFA (multi-factor authentication) adds a second step when someone signs in, such as approving a prompt on a phone. It means a stolen password on its own isn’t enough to get into an account. It’s one of the simplest security controls a business can add, and one of the first things insurers and auditors ask about.
If you can’t turn it on everywhere at once, here’s where to start.
1. Email
Email is where password resets go. Someone who controls your email can reset almost everything else, and can send invoices that look like they came from you. Turn MFA on for every mailbox first, including shared and former-employee mailboxes that still exist.
2. Admin accounts
Accounts that can change settings, add users or reset passwords should always have MFA. That includes your Microsoft 365 or Google Workspace admin, your domain registrar, your firewall and your accounting system’s administrator.
3. Remote access
Anything that lets people in from outside the office: VPNs, remote desktop tools and cloud file access.
4. Money and payroll
Online banking, payroll and payment platforms. Many already offer MFA; it just isn’t switched on.
5. Everything else
Line-of-business apps, vendor portals and social media accounts. Work through them once the big five are done.
Which kind of MFA?
Not all MFA is equal. Text-message codes are better than nothing but can be intercepted. App-based prompts with number matching, where you type a number shown on the sign-in screen, are stronger. The strongest options are phishing-resistant methods such as security keys, which the U.S. Cybersecurity and Infrastructure Security Agency (CISA) recommends where they’re available.
How we handle it
At ITAssurance℠, MFA is on every account we manage, including admin and email. It’s part of SecurityAssurance℠, the security work behind our managed IT.
Frequently asked questions
What is MFA?
MFA (multi-factor authentication) adds a second step when someone signs in, such as approving a prompt on a phone or using a security key. It means a stolen or guessed password on its own isn't enough for someone to get into the account.
Where should a small business turn on MFA first?
Start with email, because password resets go there. Then admin accounts, remote access tools such as VPNs, and banking, payroll and payment platforms. After those, work through line-of-business apps, vendor portals and social media accounts.
Is text-message MFA good enough?
Text-message codes are better than no MFA, but they can be intercepted. App prompts with number matching are stronger, and phishing-resistant methods such as security keys are stronger still. CISA recommends phishing-resistant MFA where it's available.
See what’s included in SecurityAssurance.
Source: CISA, Guidance on phishing-resistant and numbers matching MFA.
General information for business owners. It isn’t legal, compliance or insurance advice for your specific situation.
