MFA and Passwords Without the Usual Confusion

Begin with the accounts that can change money, domains, customer data, or the public website. Give each person an individual login, turn on multifactor authentication, and remove access when roles change. A shared spreadsheet of passwords is not a recovery plan.

Use a reputable password manager and document the emergency process separately from everyday credentials. Security keys, authenticator apps, and recovery codes each have trade-offs; the right choice is the one the team can use and replace. Never make a single person the only path to a critical account.

Review access quarterly and after staff changes. Phishing-resistant options are worth considering for high-value accounts, but the first win is consistency. CISA’s small-business guidance is a useful starting point for turning broad advice into a short checklist.

Find the accounts that can change the business

Start with the accounts that can move money, change a domain, publish the website, export customer information, or reset another account. A Hawaiʻi small business may have a registrar, social profile, payment dashboard, booking tool, email suite, and Wi-Fi controller. Put them on one private inventory with an owner and backup owner. Security improves when the team knows what matters before it chooses an authenticator.

Diagnose access without blame

Review individual logins, administrator count, recovery email addresses, unused sessions, and the availability of multifactor authentication. Do not ask staff to paste passwords into a survey. Instead, ask whether they can sign in through the documented path and recover access without one person’s phone. A shared login may feel efficient, but it removes accountability and makes a staff departure harder to handle.

Use a staged rollout

Secure email and domain administration first, then payment, hosting, and customer systems. Use a reputable password manager with separate personal access, record emergency recovery codes offline, and test one non-production account before changing the whole team. Security keys, authenticator apps, and SMS each have different recovery and availability trade-offs. Choose a method people can use during travel, device loss, or a weak connection.

A local operating example

A two-person North Shore studio may have one founder receiving every verification code. That arrangement creates a single point of failure if the phone is lost or the founder is unavailable. A better design gives each person a named login, a documented recovery role, and a second approved factor. The business can still limit administrative power without making continuity depend on one device.

Measure the change

Track the percentage of critical accounts with MFA, the number of shared credentials retired, time to revoke access after a role change, recovery-test success, and phishing reports. Do not use MFA coverage as proof that an account is safe. Session theft, weak recovery channels, malware, and vendor compromise remain possible. Review access quarterly and after a new hire, departure, or platform migration.

Mistakes, limits, and sources

Avoid forcing one factor type on every account without considering recovery, storing backup codes in the same place as passwords, or giving every employee administrator access. Never describe this article as a compliance determination. CISA’s small-business resources and NIST Digital Identity Guidelines explain the security concepts; the provider’s current documentation determines the actual setup steps.

Field note

Treat access review as maintenance rather than a disciplinary event. Ask what would happen if a phone were lost during travel or if the only administrator were unavailable for a week. The answer should lead to a documented recovery route, not an improvised request for a password. Recheck the route after every identity-provider change.

Primary references: CISA: Secure your business · NIST Digital Identity Guidelines