Passwords and MFA for Small Businesses: The Setup That Actually Works

Short answer: a small business needs three things: a password manager for every employee, unique passphrases of at least 14 characters generated by that manager, and multi-factor authentication (MFA) on email, banking, Microsoft 365 or Google Workspace, and any remote access, using an authenticator app or passkey rather than text-message codes. That setup takes an afternoon for a 10-person office and closes the door that most break-ins walk through.

This post was first published in 2016 and rewritten in October 2026. The advice changed: the services we recommended then are not the ones we recommend now, and text-message codes are no longer enough.

Why do passwords still matter if we have a firewall?

Because most small business break-ins do not come through the firewall. They come through a login: a reused password that leaked from some other website, or a phishing email that captures a real password. Once an attacker is inside a mailbox they read invoices, impersonate the owner and redirect payments. The FBI’s Internet Crime Complaint Center counted $2.77 billion in business email compromise losses in 2024 alone. The fix is not a better firewall; it is making the login itself hard to steal.

What makes a good password in 2026?

Length beats complexity. A 14-character passphrase such as harbor-fog-tuesday-lamp is far harder to crack than P@ssw0rd1! and far easier to type. Three rules:

• 14 characters minimum. Longer for anything financial.
• Unique for every account. Reuse is how one leaked password becomes ten.
• Generated and stored by a password manager, so nobody has to remember any of them except one master passphrase.

You do not need to rotate passwords on a schedule any more. Change a password when there is a reason: a breach notice, a departed employee, a shared account.

Which password manager should a small business use?

Any of the current business-tier managers (1Password Business, Bitwarden Teams, Keeper, Dashlane) does the job. What matters is the business features, not the brand: an admin console so the owner can add and remove staff, shared vaults for accounts a team uses together, and a recovery process for a forgotten master password. Avoid storing company logins in a personal free account; when that employee leaves, so do the passwords. Browser-saved passwords are better than a sticky note and worse than a manager.

What is multi-factor authentication and which kind should we use?

MFA means a login needs something beyond the password: a code from an app, a tap on a phone, a hardware key, or a passkey. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ranks the options in its guidance on phishing-resistant MFA:

1. Phishing-resistant MFA (passkeys, FIDO2 security keys): the gold standard. A fake login page cannot capture it.
2. App-based MFA (Microsoft Authenticator, Google Authenticator, Duo) with number matching: a reasonable interim option.
3. SMS or voice codes: the weakest form, because codes can be phished, intercepted, or taken with a SIM swap.

For a small business the practical path is: passkeys where the service supports them (Microsoft 365 and Google both do), an authenticator app everywhere else, and no SMS codes on anything that touches money or email.

Which accounts must have MFA?

• Every email mailbox, without exception, including shared ones like info@ and billing@
• Microsoft 365 or Google Workspace admin accounts (turn on Microsoft’s Security Defaults or Conditional Access)
• Online banking, payroll, merchant services, accounting software
• Remote access: VPN, remote desktop tools, cloud consoles
• The password manager itself
• Social media accounts the business posts from

How do we roll this out without a revolt?

1. Pick the password manager and create the company account. One hour.
2. Import everyone’s existing browser-saved passwords into their vaults. Thirty minutes per person, usually done in a group session.
3. Turn on MFA for email first. Walk each person through installing the authenticator app. Ten minutes each.
4. Replace the worst passwords (reused, short, shared) with generated ones over the following week.
5. Write a one-page policy: manager required, 14-character minimum, MFA on the list above, no password sharing by chat or email.

Inside a managed IT agreement this is part of onboarding. For everyone else it is a half-day project we run for Portland-area businesses as part of cybersecurity services.

Frequently asked questions

Is a password manager safe? What if it gets hacked?

Reputable managers encrypt your vault with your master passphrase before it ever leaves your device, so a breach of the vendor exposes encrypted data, not your passwords. Choose a long master passphrase and turn on MFA for the manager itself.

Do we still need to change passwords every 90 days?

No. Forced rotation produces weaker, predictable passwords. Current guidance from the National Institute of Standards and Technology favors long unique passwords changed only when compromised.

What is a passkey?

A passkey is a login credential stored on your phone or computer and unlocked with your fingerprint, face or device PIN. It cannot be typed into a fake website, which is why CISA classes it as phishing-resistant. Microsoft, Google and Apple accounts all support them.

Can our IT provider see our passwords?

Not if the manager is set up correctly. An administrator can add and remove users and recover access, but cannot read a user’s vault.

Sources

• CISA, Implementing Phishing-Resistant MFA fact sheet: cisa.gov
• FBI Internet Crime Complaint Center, 2024 Internet Crime Report (released April 2025): business email compromise losses of $2.77 billion

Cite this page: “Passwords and MFA for Small Businesses: The Setup That Actually Works”, Information Systems of Maine, Portland, ME, updated October 2026.

Need the setup done? Request IT help or call 207-653-4143.

Rick Lorello Founder

Rick Lorello founded Information Systems of Maine to give small businesses in the Portland area dependable, local IT support. Before ISM he worked at Spinglass and the Portland Water District and spent 10 years at TD Insurance. He holds a BS from Husson University and an MS from the Florida Institute of Technology.

See Full Bio