What To Do
Create A Unique Password For Each Account
Use long, unique passwords stored in a trusted password manager. Never share them over email.
Turn On Multifactor Authentication
Prefer passkeys or security keys where available; an authenticator app is better than having no MFA.
Limit Who Can Sign In
Give people only the access they need and remove accounts promptly when roles change.
Know How To Recover
Keep recovery codes somewhere secure and make sure at least one authorized person can restore critical access.
Where To Start This Week
Begin with the accounts that would hurt most to lose: business email, domain registration, online banking, and your website or store. Confirm who owns each one and whether a second trusted person can help with recovery. If the business uses a shared login, plan a safer way to give people individual access without interrupting their work.
Make one change at a time. First secure the main email account, then move to services that use that email for password resets. A password manager can make unique credentials manageable, while multifactor authentication adds a separate layer of protection. Keep backup recovery codes somewhere protected and accessible to the appropriate owner.
Related Guides
For a broader plan, use our small business cybersecurity checklist. If something seems suspicious, read what to do after a possible phishing attempt or explore our cybersecurity services.
Go Deeper
For detailed guidance, consult the official resource:
FTC Cybersecurity for Small Business ↗General education only. The right steps depend on your actual systems, obligations, and goals.