Multi-factor authentication in a small office: where to start

Passwords get stolen, guessed and reused. Multi-factor authentication (MFA) adds a second proof, such as a code from an app on your phone, so a stolen password alone is not enough to get in. For a small office, the hard part is not understanding it. It is deciding where to begin so the rollout does not turn into a month of grumbling.

This guide gives an order of operations, a plain comparison of the common methods, and a checklist. It is general education, not legal advice. Check the current text of any rule that applies to you, and ask your IT provider for specifics about your systems.

Why it comes up

The FTC Safeguards Rule (16 CFR Part 314) applies to non-bank financial institutions, including tax preparers and many accounting firms. Among other things, it lists multi-factor authentication as part of the access controls for covered firms. If you prepare taxes, MFA is not just good practice; it is named in the rule. Other offices, including insurance, title and law offices, may find that clients, partners or insurers ask about it; insurance agencies may also be covered by their state's insurance data-security law. Ask your own broker and advisors what they expect. The FTC site is at https://www.ftc.gov.

The order: email, then business software, then remote access

1. Email first

Email is the master key. Most password resets are sent to email, so whoever controls a mailbox can often take over everything else. Start with every staff mailbox, and begin with the owner's and the office manager's. Then cover shared mailboxes and any account that can forward mail.

2. Accounting, tax and practice software

Next, switch on MFA in the systems that hold client records: your tax or accounting package, practice management system, billing portal, and any cloud storage. If a product offers MFA, enable it for all users, with extra attention to administrators. If it does not, ask the vendor, and note the answer in your records.

3. Remote access

Last, protect the ways people reach the office from outside: VPN, remote desktop tools, and any cloud admin consoles. These are attractive targets because a single login reaches a lot. Your IT provider should be involved here, as a mistake can lock people out.

Authenticator apps versus text codes

At a general level, there are a few options:

• Authenticator app. An app on a phone generates a short code that changes every thirty seconds or so. It is generally stronger than text messages and works without cell service.
• Text message codes. Easy to use and better than a password alone, but codes can be intercepted in some attacks, such as a phone number being transferred to a thief.
• Hardware security keys. A small physical device you plug in or tap. Strong, but they need to be bought and managed.
• Push approvals. The app asks "was this you?" Convenient, though people can approve a request without thinking, so train staff to deny anything they did not start.

If you can only pick one for most staff, an authenticator app is a sensible default. Use text codes where nothing else is offered, since it still beats no second factor.

Recovery codes: do not skip this step

When you enable MFA, many services show a set of one-time recovery codes. These are what let you back in if you lose or replace your phone. Save them when they appear, and store them somewhere safe and separate from the phone, such as a locked drawer or a password manager the office controls. Do not leave them in a note on the desktop or in an unprotected file. Also decide who in the office can reset MFA for a colleague, and how that person verifies the request is real. Attackers often call pretending to be locked out.

The MyVaultMate dashboard

MyVaultMate requires two-factor authentication for every sign-in, for customers and for our own staff. It uses an authenticator app, which generates a short code that changes about every 30 seconds, and the Windows and Linux programs ask for the same code when you sign in from them. Staff access to the dashboard on our side is role-gated and logged.

A rollout checklist

1. List every system that holds client data or can reset a password for one.
2. Rank them: email, then core business software, then remote access, then everything else.
3. Pick the default method (authenticator app) and a fallback.
4. Turn it on for administrators and owners first, then a pilot group, then everyone.
5. Save recovery codes in a secure place when each is issued.
6. Write a short help sheet for new phones and lost phones.
7. Name who can reset MFA and how identity is verified.
8. Review the list every few months and when someone joins or leaves.

MFA does not replace a written security program, careful access controls or an IT provider. It closes one very common door. It also pairs well with knowing where sensitive files sit: MyVaultMate helps you find exposed data on your computers, while MFA protects the accounts that can reach it.