What Is Multi-Factor Authentication and Which Business Accounts Need It?

By Bill Stilwell · Last reviewed October 17, 2026

The short answer

Multi-factor authentication (MFA) means logging in takes your password plus a second proof, like a code from an app, a security key, or a phone prompt. Turn it on for every business account that offers it, starting with email, the Google account that owns your Business Profile, your domain, your bank, and your website. The Cybersecurity and Infrastructure Security Agency (CISA) says any MFA is better than none, and phishing-resistant MFA is the strongest.

What this means

11.7.3 Multi-factor authentication

MFA asks for two kinds of proof: something you know (a password) and something you have (a phone or key) or are (a fingerprint). If a scammer steals your password, they still can’t get in without the second part. Google calls its version 2-Step Verification.

Common types, from strongest to weakest, based on CISA’s guidance:

Phishing-resistant MFA: security keys or passkeys using the FIDO standard. CISA calls this the standard to aim for, because it won’t work on a fake login site.
Authenticator app with number matching: you type a number shown on screen into the app. CISA suggests this when phishing-resistant MFA isn’t possible yet.
Authenticator app codes or push prompts.
Text message or voice codes. Better than nothing, but easier to steal.

15.2.5 Administrator access

People with admin rights, in your customer relationship management (CRM) system or anywhere else, should use a separate admin account for admin work and protect it with MFA. Daily work happens in a regular account with fewer rights. If the daily account is phished, the admin powers aren’t exposed.

Made-up example: Summit Roofing’s owner gets an email that looks like a Google warning and types her password into a fake page. Because her Google account uses a security key, the scammer can’t sign in, and her GBP stays safe.

Why it matters

Passwords leak. CISA says users who turn on MFA are much less likely to get hacked.
Email is the master key. Whoever controls your email can reset almost everything else.
Some rules require it. The Federal Trade Commission (FTC) Safeguards Rule requires MFA for anyone accessing customer information at covered financial businesses.
Admin accounts are the biggest prize. One admin login can remove everyone else.

Who this applies to

Every business. Solo owners need it as much as teams do, because there’s no one else to notice an attack.

How to do it

List your accounts in your access inventory (see 11.7.5 Access Inventory). Mark the most important: email, domain registrar, website host, the Google account for GBP, bank, payment processor, payroll, password manager, CRM, and social accounts.
Turn on MFA for each, starting with email and the password manager.
Pick the strongest type each site offers. Security key or passkey first, then an authenticator app, then text codes.
Buy two security keys per admin if you use them, one for daily use and one kept safe as a spare.
Save backup codes in your password manager or a locked place (see 11.7.4 Account Recovery Methods).
Set up separate admin accounts for people who manage users or settings, and protect them with MFA.
Use business phones and numbers for MFA where you can, not a helper’s personal cell.
Check every few months that MFA is still on and that each method still belongs to a current person.

What proof to keep

A column in your access inventory showing MFA status and type for each account
Screenshots of MFA settings for key accounts, with numbers blurred
A list of security keys and who holds them
Backup codes, stored safely

Common mistakes

MFA tied to a former employee’s phone. When they leave, you’re locked out.
Turning on MFA without saving backup codes.
Approving a login prompt you didn’t start. Attackers send many prompts hoping you’ll tap yes.
Protecting email but not the domain registrar. Whoever controls the domain can redirect your email.
Admins doing daily work in admin accounts.

When to get help from a pro

Information technology (IT) specialist: if you have many staff or need to enforce MFA across a company email system. Questions to ask:

Can we require MFA for everyone in our email system?
Which accounts support security keys or passkeys?
How do we recover if an admin loses their key?

Bill’s note

[Bill: add a short note. For example, a client whose Google Business Profile was taken over because the owning account had no 2-Step Verification, or how you set up MFA on SiteSmarty’s Google account.]

If you’d rather have this done for you, SiteSmarty handles Google Business Profile setup, including securing the owner account.

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: which accounts I turned MFA on for and which type I used]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: 2-Step Verification settings for the GBP owner account]
[Result so far:]

Questions people ask

What is the safest type of MFA? Phishing-resistant MFA, like FIDO security keys or passkeys. CISA calls it the standard to aim for.

Is a text message code good enough? It’s much better than no MFA. If an account offers an app, a passkey, or a key, use that instead.

Which accounts should I protect first? Email, the password manager, the domain registrar, the Google account that owns your GBP, and your bank.

Should admins use separate accounts? Yes. Use a separate admin account with MFA for admin tasks and a regular account for daily work.

Audit check

Line	Question	Pass looks like	Fail looks like	Evidence to collect
11.7.3 Multi-factor authentication	Is MFA on for every key business account?	MFA on for email, domain, GBP owner account, bank, password manager, and others that offer it	No MFA, or MFA on email only	Access inventory MFA column, settings screenshots
15.2.5 Administrator access	Do admins use separate admin accounts protected by MFA?	Separate admin logins, MFA on, used only for admin work	Daily work in admin accounts, no MFA	Admin user list, MFA settings

Where this fits

Do this first: 11.7.2 Password Manager

Do this next: 11.7.4 Account Recovery Methods

Sources

Cybersecurity and Infrastructure Security Agency, "More than a Password" (multifactor authentication) (checked October 17, 2026)
Federal Trade Commission, "Cybersecurity for Small Business" fact sheets (checked October 17, 2026)
Federal Trade Commission, "FTC Safeguards Rule: What Your Business Needs to Know" (checked October 17, 2026)
Google Account Help, "Sign in with backup codes" (checked October 17, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.