Multi-factor authentication is one of the highest-value security steps a small business can take, and one of the most postponed, usually for fear of lockouts and complaints. A planned rollout avoids both.
1. Inventory the accounts that matter
Start with the systems where a stolen password would hurt most:
- Email, which is the key to resetting everything else.
- Banking and payment platforms.
- Remote access to office computers or networks.
- Tax, accounting, payroll, and practice software.
- Cloud storage and document portals.
- Administrator accounts for any of the above.
2. Choose the method
Prefer authenticator apps or hardware security keys over text-message codes. Administrators and anyone with access to payments should use the strongest option available. Use SMS only where a system offers nothing better.
3. Prepare recovery before enforcing
Lockouts happen when phones are lost or replaced. Before enforcing MFA:
- Record backup codes for each account and store them securely.
- Make sure at least two administrators can reset another user’s MFA.
- Write a short procedure for a lost phone.
4. Pilot, then roll out
Enable MFA for one or two people first, ideally including someone less comfortable with technology. Fix whatever confuses them. Then roll out to everyone, account by account, with a short walkthrough. Schedule it away from deadlines such as filing season, harvest, or a major bid.
5. Enforce it
Optional MFA is not MFA. Once everyone is enrolled, turn on enforcement so accounts cannot sign in without it. Disable legacy sign-in methods that bypass MFA where your email provider allows it.
6. Cover new and departing staff
Add MFA enrollment to onboarding, and disable accounts promptly when people leave. Stale accounts are a common way into small businesses.
7. Watch for MFA fatigue
Attackers sometimes trigger repeated push approval requests, hoping someone taps approve. Teach staff to deny unexpected prompts and report them. Use number matching where available.
MFA is a core part of every cybersecurity engagement we run and is expected in written information security plans for tax professionals.
Written by the Syntonyl team. This article is general information, not legal, tax, or financial advice.