Contents
Short answer
Most account takeovers can be prevented with a second factor. For small businesses that means MFA or passkeys wherever email, cloud, banking or admin access is involved, plus a password manager for shared logins. Recovery routes and orderly offboarding matter too.
Why does this matter for small businesses?
In small businesses many processes run through a few accounts – often one central mailbox. If it is taken over, attackers can reset other passwords, manipulate invoices or deceive customers. Shared logins in spreadsheets or chats are also hard to control when someone leaves.
- Account
- First factor: password
- Second factor or passkey
- Access
What does it include?
MFA
Additional proof via authenticator app, passkey or security key. SMS is weaker but better than no second factor.
Basic
Passkeys
Cryptographic passwordless sign-in that only works on the genuine website and is therefore robust against phishing.
Basic
Team password manager
Share logins by role and revoke them centrally when someone leaves.
Basic
Recovery codes and emergency access
Store recovery codes safely; define documented emergency access for critical accounts, such as a second admin.
Basic
Shared accounts
Personal accounts instead of shared logins wherever possible. Where unavoidable: in the password manager with clear ownership.
Useful as IT grows
Offboarding
A fixed list of which logins are blocked, transferred or changed when someone leaves.
Useful as IT grows
What does it protect against?
- Takeover of accounts with stolen or leaked passwords
- Reused passwords within the team
- Access by former staff or contractors
What does it not protect against?
- Staff handing over a code on request (SMS and app codes)
- Hijacked, already signed-in sessions on infected devices
- Payment fraud that works by deception without account takeover
Which basic measures are often enough?
- 01MFA for email, office cloud, banking, shop back end and domain registrar
- 02Password manager for all shared logins
- 03Recovery codes stored offline or in the vault
- 04Offboarding checklist covering all critical accounts
When does a more advanced solution make sense?
With several employees, admin accounts with broad rights or elevated phishing risk, phishing-resistant methods (passkeys, security keys) mandatory for admins and central sign-in (single sign-on) to manage access in one place become worthwhile.
Checklist for a team password manager
Selection criteria – without rankings or vendor recommendations.
- Individual user accounts
- Everyone signs in with their own account
- Roles and permissions
- Access controllable per team, project or vault
- Secure sharing
- Share without exposing passwords in plain text
- MFA
- Enforceable for all users
- Offboarding
- Revoke access centrally, transfer logins
- Recovery / emergency access
- Defined, without a back door for unauthorised people
- Logging, where relevant
- Who accessed what and when?
- Device support
- All systems and browsers used in the business
- Administration
- Managed by at least two people
- Export / switching vendors
- Data fully exportable
- Data protection and business requirements
- Storage location, contract terms, data processing agreement
Common mistakes
- Enabling MFA on some accounts and forgetting the main mailbox
- Not storing recovery codes and getting locked out after device loss
- Approving push prompts you did not trigger
- Blocking leavers' access weeks later
Checklist
- MFA or passkey active on all email and admin accounts
- Shared logins in the password manager, not spreadsheets
- Recovery codes stored safely and findable
- At least two people can recover critical accounts
- Offboarding list exists and is used
Frequently asked questions
Is SMS enough as a second factor?
SMS is better than nothing but more vulnerable than an app, passkey or security key. Admin accounts should use stronger methods.
What about accounts without MFA support?
Long unique password in the password manager, access limited to few people, and check whether an alternative exists.
Do freelancers need a team password manager?
Not necessarily. A good personal password manager is enough as long as no logins are shared.
Sensible next step
Check today whether your central email account and office cloud access are protected with MFA.
Sources
- Bundesamt für Sicherheit in der Informationstechnik (BSI)
- FIDO Alliance – Passkeys
- CISA – Cybersecurity and Infrastructure Security Agency
Checked on 6 Oct 2026.
General orientation – does not replace an individual security review, legal or data-protection advice.