The short answer: Most account break-ins at small businesses still come down to two things: a password that was reused or guessed, and no second step to stop a stolen password from working. A company password manager plus multi-factor authentication (MFA) on every account closes both gaps, and you can roll it out to a small staff in a few focused weeks without a big budget.

Neither tool is new or exotic. The federal government's own technical password standard, NIST SP 800-63B, now actively recommends password managers rather than tolerating them, and the Cybersecurity and Infrastructure Security Agency (CISA) lists MFA as one of its core actions for small and medium businesses. The harder part isn't picking the technology — it's getting a staff of 10, 30, or 80 people to actually use it. Here's a practical order of operations.

Rolling Out Password Managers and MFA in 5 Steps

1. Pick one password manager for the whole company — not a personal-tool free-for-all

If staff are already using a mix of browser-saved passwords, sticky notes, and personal password apps, the first decision is simply to standardize. A business-tier password manager lets you:

• Provision and deprovision employee access centrally (critical for onboarding and offboarding)
• Share specific logins (like a shared vendor portal) with a team without emailing the password
• See, at a glance, which accounts have weak or reused passwords

NIST's current guidance (SP 800-63B) explicitly directs verifiers to "allow the use of password managers and autofill functionality" and to permit pasting passwords so a manager can fill them in — a tacit endorsement of using one. The same standard also tells us what good passwords look like now: a minimum of 8 characters when MFA is also in use (15 characters if a password is the only factor), support for up to 64 characters, and — importantly — no more mandatory periodic password changes unless there's evidence of a breach.

2. Require MFA everywhere it's offered, starting with email and finance

CISA's guidance for small and medium businesses is direct: require MFA because strong passwords alone are no longer enough. CISA recommends starting with administrator accounts and any staff handling sensitive data, then expanding to email, file storage, and remote access for everyone else. In practice, for a 5-to-100-person Massachusetts office, that usually means: email and Microsoft 365 or Google Workspace first, then accounting/banking logins, then line-of-business software, then everything else.

Not all MFA is equally strong. CISA ranks methods roughly like this, strongest first: security keys, authenticator apps with number matching, authenticator apps with time-based codes, biometrics, and — only as a last resort — text message or email codes. If a vendor only offers SMS codes, that's still far better than no MFA at all, but push toward an authenticator app or security key where you have the choice.

If your staff is on Microsoft 365 — see our Microsoft 365 security checklist for the fuller picture — there's a built-in starting point: Microsoft's own documentation shows that security defaults let any Microsoft 365 tenant — including the free and basic tiers — turn on baseline MFA for every user with one toggle, before you've bought any additional licensing. Businesses with Microsoft 365 Business Premium or Entra ID P1/P2 can layer in Conditional Access for more granular rules later.

3. Migrate logins in batches, not all at once

Trying to move an entire staff's passwords into a new manager and turn on MFA for every system in a single week usually backfires — people get locked out, give up, and go back to old habits. A steadier approach:

• Week 1: IT/admin accounts and email
• Week 2: Finance, payroll, and banking logins
• Week 3: Line-of-business and practice-management software
• Week 4: Everything else, plus a sweep for any shared or "department" logins still being passed around verbally

As each system moves over, have the employee generate a new, unique password through the manager rather than just storing the old one — that's where the actual security benefit comes from.

4. Write down the policy, including what happens when someone leaves

A password manager is only as good as the offboarding process behind it. When an employee leaves, their individual vault access should be revoked immediately, and any shared logins they could see should be rotated. This is exactly the gap identified in a broader onboarding and offboarding checklist — password manager access is one more account to add to that list, not a separate process.

5. Train staff on the two mistakes that undo all of this

Two habits quietly defeat both tools: writing the master password down somewhere unprotected, and approving an MFA prompt the person didn't actually request (a tactic called "MFA fatigue" or push-bombing). A five-minute conversation covering "never approve a login prompt you didn't just trigger yourself" prevents one of the more common ways MFA gets bypassed in the real world.

Quick Self-Check: Where Does Your Business Stand?

1. Password manager: Does your business provide one, or is everyone on their own with browser-saved or reused passwords?
2. Email MFA: Is multi-factor authentication required — not just available — on every employee's email account?
3. Finance and banking: Are the accounts that touch money protected with MFA specifically, not just a password?
4. Offboarding: When someone leaves, is there a checklist step for revoking their password manager and MFA access the same day?
5. Backup access: If an employee loses their MFA device, is there a tested, documented recovery process — or would it mean a scramble?

Common Questions

Is a free password manager good enough for a small business?

A free, personal-tier password manager can be fine for an individual, but it typically lacks centralized administration — the ability for an owner or IT admin to see account health, revoke access instantly when someone leaves, or share specific logins securely with a team. For a business with any staff turnover, a business-tier plan earns its cost back the first time an employee departs.

Do we really need MFA if we already require strong passwords?

CISA's guidance is explicit that strong passwords alone are no longer considered sufficient, because passwords can be phished, reused across a breached site, or guessed. MFA stops a stolen password from being enough on its own to get into an account.

Which MFA method should we use if we can't afford security keys for everyone?

An authenticator app (installed free on a phone) is a strong, low-cost middle ground recommended by CISA, well above SMS text codes. Reserve SMS/email codes for systems that don't offer anything stronger. Password managers and MFA are two pieces of a bigger picture — see our broader rundown of practical tips for keeping business data secure for the rest.

Does turning on MFA slow employees down?

There's a brief adjustment period, but most authenticator-app approvals take a few seconds. Microsoft's own data, cited in its Conditional Access documentation, associates MFA with a greater than 99.9% reduction in the likelihood of account compromise — a small daily step in exchange for substantially lower risk of a time-consuming account takeover.

How Bridge IT Services Helps Massachusetts Businesses

Bridge IT Services, based in Braintree, MA, supports Massachusetts businesses within about 50 miles of our office with managed IT, network, and security support, including help planning and rolling out password management and MFA policies across a staff. If you're not sure where your organization stands today, a conversation is a good place to start.