~ / blog / mfa-for-business-tools
Turn on MFA for the tools your business runs on
Updated October 10, 2026
Start with admin accounts and anyone who handles sensitive data, then turn it on everywhere else you can. Use a security key or an authenticator app where the tool supports one, and keep text or email codes for accounts with nothing better. That's the short version of CISA's advice for small and medium businesses.
Why a password isn't enough
CISA: "Strong passwords help, but they are no longer enough to keep accounts and systems safe when used alone. Multifactor authentication (MFA) adds an extra layer of protection by requiring two or more ways to verify a user's identity."
Where to turn it on first
CISA's first step is "Require MFA wherever possible." It names the systems: "Work with your IT team or provider to turn on MFA across systems like email, file storage and remote access. Start with admin accounts and employees who handle sensitive data."
It also says to "Confirm that all remote access to the organization's network and privileged or administrative access requires multifactor authentication."
On a small team, admin accounts also include the logins that connect your tools to each other: the account that owns your CRM, your billing system, your domain and email settings, and any account an automation signs in with.
Which method to use
"Not all MFA methods offer the same level of protection. Any MFA is better than none, but some are much stronger at keeping attackers out, like phishing-resistant MFA." CISA lists the options "From most to least secure":
- "Security key"
- "Authenticator app with number matching"
- "Authenticator app with one-time code"
- "Biometrics"
- "Text or email code"
On the last one, CISA says it "provides the weakest protection. Use only if stronger options aren't available for that account."
Tell your team why
CISA's last step is "Educate your employees." It suggests telling them "they're protecting themselves, your company and your customers by taking one quick extra step."
What this page does not decide
This guide doesn't pick an MFA product or configure a specific tool. Some industries have their own security rules, and those come first. For a specific setup, talk with your IT provider.
Frequently asked questions
Which accounts should have MFA first?
CISA says to "Start with admin accounts and employees who handle sensitive data", and to require it for "all remote access" and for "privileged or administrative access".
What's the most secure type of MFA?
CISA lists a security key first, "From most to least secure". Text or email codes come last and provide "the weakest protection."
Is SMS two-factor still worth using?
"Any MFA is better than none," per CISA. Use text codes "only if stronger options aren't available for that account."
Sources
This page is run by FloHub.