MFA and Password Hygiene for Small Teams (Without Enterprise Theater)
Small teams get burned by reused passwords and shared logins. Here’s a practical MFA and password routine you can install in a week.
Part of the Business Cybersecurity Basics series. Start here: Cybersecurity checklist for small businesses.
You don’t need a zero-trust slide deck to stop the most common account takeovers. You need unique passwords, MFA on the accounts that matter, and a ban on the shared “team@” login that everyone knows.
Week-one priorities
- Email and DNS registrar - if these fall, attackers reset everything else.
- Cloud admin (Google/Microsoft 365), banking, and payment processors.
- Code hosts and production cloud consoles.
- CMS and ecommerce admin.
Turn on MFA before you debate password length policies. Length matters; MFA matters more when phishing succeeds.
Password rules people will keep
- Unique password per system - generated, not invented.
- Store them in a manager (see choosing a password manager).
- Generate strong secrets with Password Generator; spot-check with Password Strength.
- No sticky notes, no shared docs titled “passwords.”
MFA choices that fit small teams
Prefer authenticator apps or hardware keys over SMS when you can. SMS is better than nothing and worse than app-based TOTP for targeted attacks. For learning and lab setups, TOTP Studio helps you understand the moving codes - production accounts should live in a real authenticator or hardware key.
Save recovery codes in the password manager vault, not in the same inbox you’re protecting.
Shared access without shared passwords
Use proper multi-user seats. If a vendor only offers one login, put it in the company vault with an audit trail of who checked it out - and pressure the vendor to grow up.
Offboarding in one checklist
- Revoke SSO and vault access same day.
- Rotate shared secrets the person could reach.
- Reassign MFA-protected ownership where they were the only admin.
More context lives in the broader SMB cybersecurity checklist.
A path toward phishing-resistant MFA
Start with authenticator apps everywhere. Move admins to hardware keys when budget allows. Number-matching push notifications beat blind approve/deny prompts. Reminding people that IT will never ask for MFA codes over chat still matters.
Schedule a 20-minute drill: everyone confirms they can sign in with MFA and that recovery codes are stored. Drills find problems before travel week does.
Password reuse audit
Many managers report reused passwords. Run that report, then rotate the worst offenders first (email, bank, cloud). Generated replacements from a local generator are fine - the vault syncs them. Don’t invent clever patterns; invent nothing.
Contractors and temporary access
Time-box accounts. Prefer SSO with expiry. When SSO isn’t available, vault sharing with an end date beats mailing passwords. When the contract ends, revoke the same day - not Friday “when someone remembers.”
Field notes from teams who shipped this
The pattern that keeps showing up: write the constraint first, then the steps, then the failure modes. Teams that only publish happy-path screenshots create tickets. Teams that document the ugly path create trust.
Schedule a short review ninety days after publishing. Check whether product UI names still match, whether linked tools still exist, and whether support still hears the same questions. Update the page or merge it. Standing still is how useful posts become interchangeable again.
If you adapt this article for internal wikis, keep the examples tied to your stack names. The moment you generalize back to “best practices for organizations,” you’ve started erasing the specificity that made the piece worth saving.
Executive exceptions are incidents waiting
The CEO “doesn’t have time for MFA” is how business email compromise starts. If anyone gets an exception, time-box it, monitor the account harder, and remove the exception publicly when it expires. Quiet permanent exceptions become culture.
Board and finance accounts deserve hardware keys first, not last. Money movers are targets.
Write the exception log in the same place you track vendors. Auditors like boring evidence.
Pair this work with the broader SMB checklist so MFA isn’t the only control you celebrate before neglecting backups.
Lost phone protocol
Write the steps: who to call, how to use recovery codes, how to revoke the old authenticator, how to enroll a new device. Practice once. The first lost-phone event at an airport is a bad time to invent process.
Store recovery codes offline for break-glass admins with dual control if your threat model warrants it.
Password reset paths
Attackers love reset flows. Ensure MFA sits on the email inbox that receives reset links. Review how long reset tokens live. Disable legacy challenge questions.
For shared operational mailboxes, prefer individual accounts with group access over one shared password. Shared inboxes with weak MFA are a classic compromise path.
After any suspected phishing click, reset passwords and MFA for the affected user before you finish the forensics essay. Speed first, elegance second.
Physical keys for the few who need them
Not everyone needs a hardware key on day one. Admins, finance, and anyone who can change DNS or payout settings do. Buy a spare key per critical person and store it in a sealed envelope with dual control if that fits your size. Cheap keys beat expensive incidents.
Train people to reject unexpected MFA prompts while traveling. Fatigue attacks work because humans are tired, not because the crypto failed.
FAQ
Is SMS MFA worthless?
No. It’s a step up from passwords alone. Just don’t stop there for high-value accounts.
What about MFA fatigue prompts?
Prefer number-matching or hardware keys so users aren’t trained to approve blind pushes.