MFA for Small Business (What to Enforce)

MFA priorities (the “top 10 accounts” list)

If you do nothing else this month, enforce MFA on these accounts first:

1. Global admins and any admin roles
2. Email accounts (Microsoft 365 / Google Workspace)
3. Password manager accounts
4. Accounting + payments (bank, ACH/wire portals, accounting SaaS)
5. Remote access tools (VPN, RMM, remote desktop)
6. Domain registrar and DNS hosting
7. Website hosting and forms systems
8. Payroll and HR systems
9. CRM + customer communications platforms
10. Any vendor portal with admin-level access

Best MFA methods (and what to avoid)

Not all MFA methods are equal. In most small businesses, a practical order of preference is:

• Authenticator app (TOTP): solid baseline for most accounts
• Push MFA: convenient, but train users to deny unexpected prompts
• Hardware keys: best for admins and high-risk accounts
• SMS: better than nothing, but treat as a temporary step

For most teams, the biggest mistake is “MFA everywhere” without a recovery plan. That’s how lockouts happen.

Rollout plan for small teams

1. Pick your MFA standard (authenticator app for most users; hardware keys for admins if possible).
2. Start with admin roles and finance-related systems.
3. Roll out email MFA next (it’s the most common compromise path).
4. Set a clear deadline and provide a 15-minute setup session.
5. Document the recovery process before you enforce.

Break-glass accounts and recovery rules

A “break-glass” account is an emergency admin account with strong controls. Small businesses should:

• Use a named, separate admin account for emergencies
• Store recovery info in a secure vault
• Limit who can access it and when
• Log and review every use

What to do if you’re already compromised

If you suspect a mailbox compromise or suspicious sign-ins, treat it as an incident. The fastest wins are: change passwords, revoke sessions, force MFA, and verify forwarding rules and inbox rules.

Local help (Clearwater)

If you need hands-on help implementing MFA and cleanup, see IT Support in Clearwater.

FAQ

Is SMS MFA good enough?

It’s better than no MFA, but it’s not the best option for high-risk accounts. Use an authenticator app (or hardware keys for admins) when possible.

Do we need MFA on every app?

Start with the top-risk accounts (email, admins, finance, remote access). Then expand to any system that can change payments, access, or sensitive customer data.

How do we handle shared accounts?

Avoid shared accounts when possible. Use shared mailboxes and role-based access. If a shared login is unavoidable, store it in a password manager and protect the vault with MFA.

Next step

Request a security audit
Explore MSP Cybersecurity
Browse Cybersecurity articles