Ask any incident responder what would have prevented the breach and two answers come up again and again: a password that was not reused, and a second factor the attacker did not have. This guide shows a small office how to get both, person by person, without locking anyone out of their work.
People reuse passwords because remembering forty different ones is impossible, and everyone quietly knows it. Blaming staff does not fix that; tooling does. A password manager remembers everything, so each account can have a long random password. MFA then adds a second proof - usually a code or approval on a phone - so even a leaked password is not enough on its own. Together these two controls pay for almost everything else on the essentials list, because nearly every other attack becomes harder when the attacker cannot simply log in as you. This page covers the honest rollout: what to protect first, which MFA method to choose, and how to handle the people problems without drama.
Every password reset link in your office lands in a mailbox. Whoever controls the email controls the accounting login, the bank reset and the cloud admin account. So the rollout order is fixed: email accounts first, with a unique password and MFA, before anything else.
Do this for the owner and the office administrator on day one, in person, and confirm a test sign-in works before moving on. A rollout that starts by locking the boss out of email will not survive the week.
Choose one reputable password manager for the whole office so everyone learns the same tool. Sit with each person for fifteen minutes: install it, set a strong master password they choose and write nowhere, then change their five most important passwords together.
Be honest about the master password: it is the one password a human must remember, so make it a long passphrase of several words. If it is forgotten and no recovery was set up, the vault is gone by design - that is what makes it safe.
Not all MFA is equal, and the honest ranking matters. An authenticator app is the practical default for a small office: free, works without signal, and codes cannot be intercepted in transit. Hardware security keys are stronger and worth it for the owner and finance logins. SMS codes are better than nothing but weakest - phone numbers can be hijacked through SIM-swap fraud.
Whatever you choose, save the backup or recovery codes the service offers and store them in the password manager. The day a phone is lost, those codes are the difference between ten minutes of admin and a week of lockout.
Staff will say MFA slows them down. The honest answer: it adds seconds, a few times a day, and most services can remember a trusted office PC for a period. Compare that with the days of chaos after a mailbox takeover, when the attacker has read every invoice and emailed your customers from your own address.
Also expect the approval-fatigue trick: attackers who have a password sometimes spam approval requests hoping someone taps yes. Teach one rule - never approve a sign-in you did not just start yourself. Deny it and report it; that report is an early warning your password may already be out.
Offices run on awkward accounts: the info@ mailbox, the printer panel, the router, the old server login. These are exactly the accounts attackers probe first, because nobody owns them. Give each one a unique password stored in the manager, and where the service supports MFA or an app password, turn it on.
Write down who is responsible for each shared account. Shared does not have to mean anonymous - it means the password lives in the team vault and one named person keeps it current.
Every essential in this guide is explained with full knowledge and installation in the IT Security Essentials video.
Watch Full VideoThey are far better than no second factor, but they are the weakest common option because phone numbers can be taken over by SIM-swap fraud. Use an authenticator app wherever the service allows it, and keep SMS only for services that offer nothing else.
This is planned for, not a crisis. Use the recovery codes saved when MFA was set up, or have an admin reset that person's MFA so they can enrol the new phone. Verify the person's identity properly before resetting - attackers love this exact phone call.
Yes, first. Owner accounts usually have the widest access - banking, email admin, accounting - which makes them the highest-value target in the building. Leadership using the tools also ends most staff resistance instantly.