MFA (multi-factor authentication)

NIST's digital identity guidelines (SP 800-63B) describe authentication factors as something you know, something you have and something you are; MFA combines at least two. Authenticator apps, hardware security keys and device-based prompts are stronger than codes sent by text message, which can be intercepted or redirected.

For a growing business MFA is the single control most often required by the rules that already apply to it: the FTC Safeguards Rule names it, cyber insurers ask about it, and HIPAA and PCI DSS expect it for remote and administrative access. It belongs on email, the phone system portal, the firewall, remote access, the CRM, banking and every admin account, including the vendors' accounts into your systems.

Ask each vendor whether MFA is available on every login to their product, whether it can be enforced for all users rather than offered, which methods are supported, and how a lost phone or key is recovered without opening a hole. Ask your IT partner to roll it out in an order that starts with email and administrator accounts.