Enforcing Two-Step Verification Across a Business
Two-step verification only protects a business if everyone uses it. How to roll it out, enforce it in common services, choose methods and handle the awkward exceptions.
Two-step verification is one of the most effective protections for business accounts. But a single account without it is enough for an attacker. That is why enforcement matters more than encouragement.
Rolling it out
- List every service the business uses: email, file storage, accounting, payroll, social media, website.
- Announce the change with a short explanation and a deadline.
- Help people set up in a short session. See authenticator app setup.
- Turn on enforcement in admin settings once the grace period ends.
- Set up recovery: backup codes and a clear process for lost phones. See lost phone with authenticator.
Choosing methods
- Best: passkeys and security keys, which resist phishing. See passkeys vs phishing.
- Good: authenticator apps.
- Weaker: text-message codes. See why text codes are weaker.
Handling exceptions
- No smartphone: offer a security key.
- Shared devices: avoid shared accounts. See shared accounts.
- Service accounts: restrict them and review them regularly.
For more, see protecting small businesses from digital threats.
Frequently asked questions
Should we make two-step verification optional?
No. Optional settings leave gaps attackers find. Enforce it for every account, with a short grace period to set up.
Which method should staff use?
Passkeys or authenticator apps are better than text messages. Admins and finance staff should use the strongest options.
What about staff without a smartphone?
Security keys or other supported methods can work. Plan these exceptions rather than exempting people.
Sources
- More than a Password, US Cybersecurity and Infrastructure Security Agency
- Multi-factor authentication for your corporate online services, UK National Cyber Security Centre
- Implementing phishing-resistant MFA (fact sheet), US Cybersecurity and Infrastructure Security Agency
