Two-step login, in plain words

What it is

Two-step login, also called multi-factor authentication or MFA, means that a password alone does not get someone into an account. After the password, the account asks for a second proof, usually a six digit code from an app on the person's phone or a tap on a notification. A criminal who has stolen or guessed the password does not have the phone, so the login fails.

Why it matters more than any other setting

Most small business break-ins start with one email account. The password was reused from a site that got breached, or it was typed into a fake login page. With two-step login on, that stolen password is useless. Microsoft and Google have both published that the overwhelming majority of account compromise attempts are stopped by MFA. It is the one control that is cheap, fast, and decisive.

Who requires it

• Cyber insurance carriers, as a condition of coverage on most small business policies.
• The FTC Safeguards Rule, for anyone who accesses customer information at a covered financial institution, which includes tax preparation firms and mortgage brokers.
• HIPAA does not name it today. The January 2025 proposed Security Rule update would require it, and it already answers the access control question in a risk analysis.
• Card processors, for access to systems that touch cardholder data.

Where to turn it on first

1. Email, for every account including the owner, with sign-in blocked on shared mailboxes.
2. Any remote access to the office, like VPN or remote desktop.
3. The line of business software, like the practice system, the tax software, or the agency management system.
4. Banking and payroll.
5. The password manager itself.

How to do it without annoying staff

Use an authenticator app rather than text messages where the service allows it. Turn on "remember this device" for office computers so people are not prompted every morning. Enforce it at the admin level so nobody can turn it off for themselves. Give everyone a backup method, like a second phone or printed codes, so a lost phone is not a lockout. And show people once, in person, which takes about ten minutes.

What it does not do

It does not stop someone from approving a fake prompt. Criminals now send repeated login prompts hoping someone taps approve to make them stop. Tell staff to approve only logins they started, and to call if they see prompts they did not expect. That is part of our staff training session.

Turning two-step login on everywhere is part of our Microsoft 365 setup and hardening project and of every cyber insurance readiness engagement.