Protect accounts with more than a password

A stolen password should not be enough to open your business accounts. Multi-factor authentication (MFA) adds another verification factor, but the method you choose matters.

• Enable MFA wherever available. Start with email, administrator accounts, and services holding sensitive information.
• Prefer phishing-resistant methods. Where supported, use FIDO/WebAuthn options such as security keys or passkeys. SMS and one-time codes can still be phished.
• Keep access appropriate. Use unique passwords stored in a password manager, limit administrator privileges, and remove access when people leave.

One action today: Check whether your business email offers phishing-resistant sign-in.

Source: NIST — Multi-Factor Authentication