A simple 2FA checklist for small teams and businesses

Small businesses get targeted precisely because attackers assume no one's minding security. The good news: strong two-factor authentication is free, and you can roll it out to a small team in an afternoon. Here's a practical checklist.

1. Start with the accounts that would hurt most

Protect these first, in this order:

• Business email / Google Workspace / Microsoft 365 — the master key to everything else. (Google guide · Microsoft guide)
• Anything with money — banking, payment processors, payroll.
• Your domain registrar and website host — losing these can take your whole business offline.
• Social and marketing accounts — see securing social media.

2. Choose authenticator apps over SMS

Set every account to the authenticator app option rather than text messages. It's immune to SIM-swap attacks and works offline.

3. Plan for people leaving and phones breaking

• Save each account's backup codes in the company password manager.
• Keep a record of which accounts have 2FA and who holds access.
• Have an offboarding step to rotate credentials when someone leaves.

4. Use shared password management

Pair 2FA with a team password manager so everyone uses unique, strong passwords without sharing them insecurely over chat or email.

5. Train the team on the human attacks

Most breaches start with phishing or a "support" call asking for a code. Two rules cover most of it: never approve a login you didn't start, and never share a 2FA code with anyone.

Work through the checklist once and your team's security jumps dramatically. Browse setup guides for every service you use →