The short version
Everything you need to decide is here. Setup walkthroughs live in the PDF.
Protect accounts in this order
- Email, every mailbox. It resets everything else. Own the inbox, own the company.
- Banking, payroll, payment platforms. The money.
- Microsoft 365 / Google admin accounts. One admin account controls every mailbox and file.
- Remote access: VPN and remote desktop. The doors attackers scan for nightly.
- Line-of-business apps. Client data lives here.
- Company social accounts. Reputation, and a favorite for scams.
Pick your method
- Authenticator app: recommended for everyone. Free, works offline, not tied to your phone number.
- Hardware key: best for admins and finance. Phishing-resistant, about $25 to $50, buy a spare.
- Text message codes: better than nothing, but SIM-swaps happen. Not for email, banking, or admins.
- Email codes: if email is the second factor for email, it isn't a second factor.
Roll it out without ruining a Monday
- Announce it with the why and a date, two weeks out. One paragraph.
- Leadership enrolls first. It kills the 'do we really have to' question.
- Pilot one team for a week; collect the snags.
- Enforce, with a helpdesk plan for the day-one lockouts.
- Everyone stores recovery codes somewhere that isn't the protected account.
The PDF adds:
- Click-by-click setup for Microsoft 365 and Google Workspace
- Guidance for banking and vendor apps
- The lockout-prevention checklist, break-glass admin account included