Most small businesses don't get breached by a genius. They get breached by a reused password, leaked years ago from some shopping site, and an inbox that never had a second lock on it. Closing that gap takes less time than a lunch break. You can switch on multi-factor authentication (MFA) for your email, cloud storage and admin accounts in about an hour, without hiring anyone or buying an enterprise platform.
The order matters more than the speed. Here's how to do it properly.
Not every login deserves the same urgency. Attackers work backwards from whatever gives them the most control, so protect in that same order.
On the people side, start with four roles: the owner or founder (usually the one with billing access), whoever runs finance or payroll, whoever manages your cloud tenant or IT, and any assistant or office manager who can see the owner's calendar and files. Shared mailboxes like info@ or accounts@ need MFA too, even when three people use them.
Grab a notebook and write down every service that touches your business: email, file storage, domain registrar, website host, accounting, payroll, banking, social accounts, your password manager. Rank them by how much damage a takeover would cause. That list becomes your to-do list.
Next, pick your second factor. An authenticator app is the sensible default for most teams — Microsoft Authenticator, Google Authenticator, Duo or the one built into your password manager all work. Push notifications with number matching are easier for staff than typing codes, and passkeys, where supported, are smoother still. SMS codes are better than nothing, but phone numbers can be hijacked, so treat text messages as a fallback rather than the plan.
Finally, book 20 minutes with each person and do it live. MFA over a screen share takes minutes. MFA by email instruction takes weeks.
This is the one that matters most. Do it before anything else.
Sign in to the admin center. For a small tenant with no special licence requirements, turning on security defaults in your identity settings enforces MFA for everyone, which is often the fastest safe option. If you'd rather be surgical about it, the per-user MFA settings let you switch people on individually — do admins, finance and the owner first, then the rest of the team.
Warn people that their phones will start buzzing. Do it on a Monday morning, not a Friday afternoon.
In the admin console, go to Security, then Authentication, then 2-Step Verification. You can enforce it for the whole organisation or roll it out one group at a time. Google also lets you restrict which second factors are allowed — worth doing later, once everyone is enrolled. If you're on personal Gmail accounts instead, each person enables 2-Step Verification under their own account security settings.
If your files live inside Microsoft 365 or Google Workspace, you've already covered the login. The extra work here is about sharing. Check who can open links outside your organisation, remove access for people who've left, and turn on expiry dates for external shares. Dropbox users should switch on two-step verification in account settings, and team admins can require it rather than asking politely.
A stolen file share rarely announces itself. Sometimes the only sign is a link that should have stopped working months ago.
Now work through the rest of your list. Banking and accounting tools usually support MFA somewhere in account or security settings; turn it on and nominate a second person who can approve payments. Payroll deserves the same treatment.
If a login can reset your email password, redirect your domain or move money, it needs a second factor.
Don't skip your domain registrar. Whoever controls DNS can quietly redirect your email, and that's a very bad afternoon. While you're there, turn on registrar lock and make sure the contact email is a mailbox you actually control.
MFA fails in predictable ways. Handle these now, not during an incident.
Explain the reason in one sentence: this is the lock that stops a stolen password from becoming a stolen business. Show people how to add the app, approve the first prompt and save their recovery codes. Let them test it by signing in on a second device while you're there.
Expect two complaints. "It's slower" — it adds a few seconds, and number matching keeps it quick. "I lost my phone" — that's what the backup factor and recovery codes are for. Both are solvable, and neither is as expensive as a wiped mailbox.
An hour gets you protected today; small routines keep it that way. Add MFA enrolment to your onboarding checklist for new hires and remove accounts the same day someone leaves. Do a ten-minute review each quarter: check recovery codes still exist, confirm backup factors work, and make sure no new tools have appeared in your stack without a second lock.
If you use an IT provider or managed service, ask them to confirm which accounts are covered and where the gaps are — a short written answer is reasonable to request. For anything touching banking, payroll or regulated data, it's worth checking your obligations with a qualified adviser rather than assuming. Start with email this week. Everything else follows.
Photo: Pexels / Pixabay
Unassigned seats, duplicate subscriptions and forgotten renewal dates drain small IT budgets quietly. Here are ten...
Free antivirus covers basic malware blocking, but paid tiers add phishing defence, VPNs, parental controls, priority...
SSDs cut boot times and survive drops; hard drives still win on cost per terabyte. Here is how to match each drive...
Your trusted source for reliable IT solutions.
