---
source_url: "https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/require-multifactor-authentication?utm_source=openai"
title: "Require Multifactor Authentication | CISA"
mirrored_at: 2026-08-16T01:03:02.912Z
host: www.cisa.gov
cited_in_42a: true
mirror_canonical: "https://index.42a.ai/www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/require-multifactor-authentication__q__utm_source_openai"
---

> **Original source:** https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/require-multifactor-authentication?utm_source=openai

## **Multifactor Authentication Provides Extra Security** 

  
Your company’s data, including intellectual property, employee records and customer information, is a prime target for cybercriminals looking to gain access to your business. They may try to use vulnerable access points to steal information that connect them to **critical infrastructure** networks they can exploit.  

Strong passwords help, but they are no longer enough to keep accounts and systems safe when used alone. Multifactor authentication (MFA) adds an extra layer of protection by requiring two or more ways to verify a user’s identity. Businesses should aim to use a phishing-resistant MFA method. MFA helps ensure that only authorized users can access business accounts.  

According to the National Cybersecurity Alliance’s annual Oh, Behave! Survey, most regular MFA users secure banking and financial accounts, but far fewer protect work or social media accounts, highlighting the need for broader adoption. Additionally, the National Security Agency and CISA released a joint cybersecurity advisory highlighting the [top ten cybersecurity misconfigurations in large organizations exploited by scammers](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-278a), with a listed element being weak or misconfigured MFA. Lack of MFA is a serious problem, especially in critical infrastructure sectors.  

Implementing MFA into your policy is a simple, effective step that can block many common cyberattacks and significantly reduce the risk of account compromise.  

##   
**How to Use MFA in Your Business** 

  
MFA is a simple way to increase your business’s digital security. Get started securing your business with these steps.  

1.  #### **Require MFA wherever possible.**  
    
    Work with your IT team or provider to turn on MFA across systems like email, file storage and remote access. Start with admin accounts and employees who handle sensitive data. Confirm that all remote access to the organization’s network and privileged or administrative access requires multifactor authentication.   
     
    
2.  #### **Use the strongest MFA option available.**  
    
    Not all MFA methods offer the same level of protection. Any MFA is better than none, but some are much stronger at keeping attackers out, like phishing-resistant MFA. We suggest requiring one or a combination of the following MFA verification methods. **From most to least secure**, here are the main options: 
    
    -   **Security key:** Use a physical security key (like a YubiKey) to log in. It plugs in or taps your device. Provides the best protection against phishing and is easy to use.   
    -   **Authenticator app with number matching**: Anapp pushes a prompt to your phone. You enter a number shown on the login screen to confirm.  
    -   **Authenticator app with one-time code**: An app generates a new code every 30 seconds.  
    -   **Biometrics:** Uses your fingerprint or face to confirm your identity. Usually device specific. Best when used with another method.  
    -   **Text or email code**: A one-time code is sent to your phone or email. This is the form people are most familiar with, however it provides the weakest protection. Use only if stronger options aren’t available for that account.
    
    Talk with your IT team to determine the right MFA solution for your business needs. 
    

![a bar chart of different MFA security levels](https://www.cisa.gov/sites/default/files/styles/large/public/2025-08/SOW-SMB_STL_24.png?itok=RLcAlJOC)

3.  #### **Educate your employees.** 
    
    Not everyone knows what MFA is or why it matters.  
    
    Clearly communicate to your employees that they’re protecting themselves, your company and your customers by taking one quick extra step. Encourage employees to turn on MFA for their personal accounts, too.