Multi-factor authentication for a small business
Start with the accounts that control important work and recovery: email, privileged administration and other critical business applications. Ask the administrator to document coverage, exceptions and recovery arrangements before changing sign-in policies.
Minnesota based · Preparing for launch · Scope agreed before work begins
Where should our business start with MFA?
Apply the answer to your business
A company can have MFA on ordinary staff email while a separate administrator account remains outside the policy. A useful review distinguishes the accounts, applications and exceptions rather than accepting a single yes-or-no answer.
This is an illustrative situation, not a reported CX client engagement.
Turn the question into a next action
Choose the business decision you need, involve the person responsible for the system and record what is known versus what needs validation. Keep the follow-up small enough that it has a named owner and a clear finish line.
- Ask your teamWhich accounts are privileged?
- Ask your teamWhere are the exceptions and who approved them?
- Ask your teamHow can an authorized person recover access?
Evidence to bring to the conversation.
Use the agreed scope to decide which records are relevant. These items can help the business and technical owners establish a common starting point:
- An agreed account inventory
- Administrator confirmation of coverage
- A documented exception and recovery process
Missing evidence is an open question to document. It is not a reason to invent an answer or assume that the underlying system is protected.
Know the boundary
An untested policy change can disrupt legitimate access. Your administrator should validate licensing, enrollment, test users and recovery arrangements before implementation.
Ask about phishing-resistant options.
Ask your administrator which phishing-resistant sign-in options are available for sensitive and privileged accounts. A rollout still needs appropriate enrollment, testing and recovery arrangements. The NIST resource below explains why different forms of MFA provide different protections.
Published by CX Cyber Security · General education · Updated October 31, 2026. Further reading: NIST: multi-factor authentication and account access. CX’s original guide is not a NIST assessment or endorsement.
Plan your next step
Start with the business.
Get clear on the risk.
Tell us what your company does, the size of your team and what prompted your enquiry. We’ll discuss fit and the scope needed before proposing work.
Preparing for launch. Enquiries are welcome; delivery dates and engagements require finalized onboarding and a written agreement. Please do not email passwords or sensitive security evidence.