Accounts, Passwords and Two-Step Sign-In

A sign-in is the front door of every cloud account, and most of your business now sits behind several of them. So this lesson comes before backups, before email filters, before anything about networks. If a criminal can log in as you, the other defenses stand around and watch.

Every person gets their own login

In many small offices, one login serves everyone. The front desk, the bookkeeper and the owner all use office@ to get into the bank or the payroll site. It started as convenience. Now it is a risk with four separate costs.

• No record of who did what. If a payment goes wrong, you cannot tell who made it.
• No clean way to remove one person. When someone leaves, you either change the password for everyone, which usually never happens, or you leave it and hope.
• Nobody feels responsible for it. Shared passwords get written on sticky notes and texted around.
• Two-step sign-in does not work well. If the code goes to the owner's phone, every login needs the owner.

The fix is dull and effective: one named account per person per system. Most business services allow extra users at little or no cost. Banks may call this "sub-users" or "users with roles." Payroll and accounting programs almost always let you add a user and set what they can see. Where a service truly allows only one login, say a small vendor portal, put its password in the password manager's shared vault (more below) and treat it as a known exception on your list.

Passwords: long, unique, and not in anyone's head

The honest rule has two parts. Make each password long, because length beats cleverness. And never use the same password in two places. When one site is breached, attackers try the leaked passwords on other sites. That is called credential stuffing, and it works because many people reuse passwords.

CISA's ransomware guide asks for unique passwords of at least 15 characters, account lockouts after repeated failures, and changing any default administrator password (CISA #StopRansomware Guide). Nobody can remember dozens of 15-character random strings. That is what the password manager is for.

The business password manager

A password manager is a program that creates and stores long random passwords and fills them in for you. You remember one strong main password, plus use two-step sign-in on the manager itself. The business versions add what the free personal ones lack: a shared vault for the few logins that must be shared, an admin who can see which people have set up two-step sign-in, a way to remove a departing person without losing the shared logins, and sometimes a recovery option so the business can get back in if an employee is locked out.

Rough costs, as planning numbers to confirm with current prices: business password managers often run a few dollars per user per month. Some browsers and operating systems also include built-in managers that are free. For a business, a dedicated manager with admin controls is worth paying for, since the admin features are the point. Whatever you choose, check that it supports two-step sign-in, a shared vault, and an admin recovery option.

A side benefit that matters: a manager fills a password only on the exact web address where you saved it. If you land on a look-alike site and the manager offers nothing, that silence is a warning.

A short written password rule

• Passwords are created by the password manager and are at least 15 characters. Nobody types them from memory except the manager's main password.
• The main password for the manager is a passphrase of several unrelated words, not used anywhere else.
• No passwords in email, texts, sticky notes or shared spreadsheets.
• No password is shared by text or chat. Share through the manager's shared vault.
• Change a password when you know or suspect it leaked, and when someone who knew it leaves.

What about forced changes every 90 days? NIST's current digital identity guidelines say systems should not require periodic password changes, and should force a change when there is evidence the password has been compromised (NIST SP 800-63B-4). The same document sets 15 characters as the minimum for a password used alone and says systems should allow password managers. Change on cause: a breach, a departure, a suspicion.

Two-step sign-in, and which kinds are strong

Two-step sign-in (the same idea as multi-factor authentication, MFA, or two-factor authentication) means you prove who you are twice: with your password plus something else. If a criminal steals the password, they still lack the second proof. It is the single most effective step for an email or bank account, and the one almost every insurer now asks about. Any version beats none. But the versions are not equal.

CISA calls FIDO/WebAuthn the only widely available phishing-resistant authentication, and says that where you cannot get there yet, number matching helps against push bombardment and SMS-based attacks (CISA MFA guidance). Plain advice for a small business: use the strongest method each account allows, put security keys or passkeys on the accounts that can ruin you (email admin, bank, payroll, domain registrar), and use an authenticator app on the rest. Use text codes only where that is all there is.

Turning it on in Microsoft 365 and Google Workspace

Menu names change, so use the vendors' own pages linked here for exact clicks. The ideas are stable.

• Microsoft 365 (Microsoft Entra ID). Microsoft provides "security defaults" at no extra cost. As Microsoft describes them, they require all users to register for MFA, require MFA for administrators, block legacy sign-in protocols that cannot do MFA, and prompt for MFA at times Microsoft chooses, based on factors such as location, device, role and task. Microsoft says they suit organizations that want better security but do not know where to start. They are all-or-nothing, with no customization. If you have the plans that include Conditional Access (Entra ID P1 or higher), Microsoft says to use that instead. Read Microsoft's security defaults page, and check whether your tenant already has them on.
• Google Workspace. A super administrator turns on 2-Step Verification in the Admin console under Security, then Authentication, then 2-step verification. You can let users turn it on, then enforce it immediately or from a set date, give new users a grace period, and choose which methods are allowed: any method, any except text and phone codes, or only security keys (passkeys are supported in that mode). Google enforces 2-Step Verification for administrator accounts. See Google's deployment page. Warn users before blocking text and phone codes, since anyone relying on them will be locked out.

Admin accounts are different

An administrator account can change settings, add and remove users and see nearly everything. It is the most valuable thing in your business after the bank. CISA's guidance is to separate admin accounts from everyday accounts, apply least privilege, and avoid using a root or admin account for daily work (CISA). In plain terms:

• Create a separate admin login that is used only to change settings. Read email and browse the web with a normal account.
• Keep the number of admins small, usually two: the owner and one trusted backup. One is a single point of failure, since a lost phone could lock you out of your own business.
• Put security keys on admin accounts. Keep one key in a safe place away from the office.
• Do not let a vendor or outside IT provider hold the only admin login. You, the business, must be able to get in and to remove them.
• Check the list of admins every quarter. Remove anyone who does not need it.

Least privilege is the broader rule: every account gets only the access it needs. The assistant who pays bills does not need to change payroll bank accounts. The technician does not need the accounting books. Most business programs let you set a role such as "view only," "enter bills," "approve payments." Use those roles. A stolen account with narrow rights does narrow harm.

Onboarding and offboarding

Accounts go wrong at the edges of a job: the first week, when everyone grants access in a hurry, and the last day, when everyone forgets to take it away. Write both checklists once and use them every time.

Former employees and ex-contractors cause real trouble more often than you would think, and not always out of malice. A forgotten login on a payroll site or a personal phone still showing company email is a standing hole. Run a quarterly check: list everyone with access to the bank, payroll, accounting and email admin, and ask whether each person still works there. The SBA's own cybersecurity guidance says to audit access regularly, including removing former employees (SBA).

Bank, payroll and vendor portals

These accounts move money, so they get the strongest setup. Ask each bank and payroll provider what they offer. Many support authenticator apps or security keys, positive-pay or payee-approval features, and dual approval, where one person creates a payment and another approves it. Turn on text or email alerts for new payees, changes of bank details and large transfers. The FTC's small business pages and the SBA both advise checking whether your financial, accounting and payroll vendors offer MFA (FTC).

Include the less obvious ones on your list: the domain registrar (where your web address is registered, and whoever controls it controls your website and email), the website host, the card processor, the payroll service, the accountant's portal, the insurance and tax portals, and social media or review pages. A hijacked domain registration can redirect your email.

Recovery: plan for the lost phone

Two-step sign-in has a cost: it can lock you out. Handle that before it happens.

• Register at least two second steps where the service allows: for example an authenticator app and a security key, or two security keys.
• Print or save backup codes when a service offers them. Store them in the password manager's secure notes and a sealed envelope in the safe.
• Keep recovery email and phone numbers current and under business control, not one employee's personal address.
• For admin accounts, keep the second admin and a spare security key in a different place.
• Know each critical service's account-recovery process and how long it takes. Some take days.

Who does what

Questions and answers

Is a password manager safe? What if it gets hacked?

Good managers store your passwords encrypted, so the company cannot read them. The main risks are a weak main password and no two-step sign-in on the manager itself. Fix both and you are far safer than with reused passwords.

What if an employee forgets the main password to the manager?

Choose a business plan with an admin recovery option, and decide in advance who can authorize it. Test it once on a spare account.

Do I need security keys for everyone?

No. Start with the admins, the owner, the bookkeeper and whoever approves payments. Authenticator apps are fine for the rest. A security key often costs somewhere around $25 to $60, so check current prices, and buy two per person so one is a spare.

Our bank only offers text codes. What do we do?

Use them, since they beat a password alone. Add a carrier PIN on the phone account, keep the registered phone number under business control, turn on alerts, and ask the bank for dual approval and payee verification. Ask whether it plans to add app-based or key-based sign-in.

Can two people share one two-step code or one phone?

Avoid it. Shared second steps recreate the shared-login problem. If a role truly needs shared access, use a service's shared-user feature or the password manager's shared vault, with the second step on a device the business controls.

What should I do when an employee refuses to install an authenticator on a personal phone?

Offer a hardware security key or a company-owned device. It is a business rule, like a key to the front door. Apps like authenticators do not read personal data on the phone, and your phone policy (lesson 7) should say what the business does and does not see.

How often should I review who has access?

Quarterly for the bank, payroll, accounting and email admin. Yearly for everything else. Also review whenever someone changes roles.

Is it okay to let the browser save passwords?

It is better than reusing one password, and worse than a business password manager, because you lose admin controls and shared vaults. Lesson 5 covers browser settings.

Hard questions

"My staff will write passwords down anyway. Why bother with rules?"

A written password in a locked drawer is a smaller risk than the same password used on twelve sites. The manager takes away the reason to write them down. Pair the rule with a tool that makes the good habit the easy one.

"Two-step sign-in can be beaten too. Isn't it security theater?"

Weak versions can be beaten, which is why this lesson ranks them. Phishing-resistant methods can't be tricked by a fake site, and even a text code stops the mass-guessing attacks that make up most account takeovers. Use the strongest the service offers.

"We're a family business. Everybody trusts everybody. Do we need own-logins and offboarding?"

Trust and technical hygiene are separate things. A shared login still hides who acted, and a family member who leaves, falls out with the business, or loses a phone leaves the same hole. Own logins also protect the honest people, because they let you show who did not do something.

"Isn't it risky to give the outside IT provider admin rights?"

It is a real risk, and the answer is control, not avoidance. Have the provider use a named admin account, not the owner's. Make sure the business holds its own admin login, and know how to remove the provider. Review their access each quarter.

"A strong main password and a phishing-resistant key sound expensive. We have five employees."

For five people, a manager is around $20 a month at the planning prices used here, and two keys per admin run a one-time $60 to $120. Compare that to a single bad transfer. If money is tight, start with the free items: separate logins, authenticator apps and security defaults or 2-Step Verification.