Technology & security · · 6 min read · By Alexander
Two-factor authentication: essential protection for business accounts
Two-factor authentication adds a second check to the password used for a business account. A stolen or guessed password is no longer enough to sign in, provided the second factor and account recovery are configured properly.
What is two-factor authentication?
Two-factor authentication, or 2FA, combines two different types of evidence. This may be something you know, such as a password, and something you possess, such as a phone or security key. A fingerprint or face can also be part of the process. Two passwords are not genuine 2FA because both belong to the same knowledge category.
The practical benefit is straightforward: a captured password does not immediately unlock the account. Germany’s Federal Office for Information Security, BSI, recommends two-factor authentication for important online accounts and states that it significantly increases security. Source: BSI guidance on two-factor authentication and secure passwords, accessed 3 November 2026.
2FA does not stop every attack. A fake login page may request a one-time code, while careless approval of a push request can bypass the protection. Clear processes and secure recovery therefore remain essential.
Which business accounts should receive 2FA first?
Start with accounts that can unlock other services or stop the business. Business email usually comes first because it receives password reset links, sends invoices and contains confidential data. Next are administrator accounts, cloud storage, accounting, online banking, domain and hosting management, social media and advertising platforms.
Create an access register showing the service, responsible person, account owner, 2FA method and recovery route. This reveals shared credentials, former employees’ accounts and administrators without cover. Store passwords in a password manager rather than in the register itself.
Prioritise by potential damage, not daily usage. A rarely visited domain registrar may be more critical than a newsletter tool because a compromised DNS account can affect both website and email.
- Business email and central identity accounts
- Website, hosting, domain and DNS administration
- Cloud storage, accounting, banking and payments
- CRM, customer data, booking and specialist software
- Social media, Google Business Profile and advertising accounts
Which 2FA method suits a small business?
Methods provide different levels of protection. SMS is usually better than a password alone but depends on the mobile number. Authenticator apps generate time-limited codes on the device. Push approvals are convenient, but staff should see login details or number matching instead of approving every prompt automatically.
Hardware security keys and FIDO2 passkeys bind authentication more closely to the genuine service and are particularly resistant to phishing. BSI describes FIDO2 as a strong or passwordless login method and recommends strong second factors for valuable accounts. Source: BSI guidance on FIDO2 and two-factor authentication, accessed 3 November 2026.
| Method | Strength | Typical use |
|---|---|---|
| SMS code | Better than password only, but tied to the mobile number | Fallback where the service offers nothing stronger |
| Authenticator code | Works offline; codes may still be entered on phishing pages | Practical standard for small teams |
| Push approval | Convenient; vulnerable to careless approval | Use with login details or number matching |
| Hardware key / FIDO2 | Strong phishing resistance and physical control | Email, admin, cloud, domain and critical accounts |
| Passkey | Phishing-resistant login protected by the device | Where services and device management support it reliably |
Do passwords still need to be strong with 2FA?
Yes. Every account needs a unique, sufficiently long password so that a breach at one provider does not expose email, hosting or accounting. A password manager creates and stores random credentials and removes the need for minor variations of the same password.
BSI recommends a separate password for every service and the use of a password manager. Protect the manager with a long, memorable master passphrase and 2FA. Source: BSI guidance on secure passwords and password managers, accessed 3 November 2026.
Use personal accounts rather than shared logins. Individual users can receive only the permissions they need and can be disabled when a person leaves without changing one team password everywhere.
How can a small company roll out 2FA without disruption?
Assign an owner and rollout order. Pilot 2FA on email and one administrator account, document the steps and test a second device before deploying it across the team.
Plan for loss and absence: who provides a replacement device, where are recovery codes stored and can two authorised administrators recover a critical account? Keep backup codes encrypted or physically protected and separate from the everyday phone.
Give staff a short practical briefing: reject unexpected prompts, check the login address, never disclose codes by phone and report suspicious activity immediately. A managed website subscription can organise updates, backups and website roles, but the company still needs a shared process for email, cloud and other accounts.
- Create an access register and mark critical accounts
- Use personal accounts rather than shared logins
- Choose a password manager and protect it with 2FA
- Move email, admin, cloud and finance accounts first
- Test backup codes, replacement devices and delegated access
- Document account removal when staff leave
Is two-factor authentication legally required in Germany?
There is no blanket rule requiring every small company to protect every account with 2FA. Article 32 GDPR does, however, require appropriate technical and organisational measures based on risk, the state of the art and the processing context. Source: Article 32 GDPR via EUR-Lex, accessed 3 November 2026.
A password alone is harder to justify for health data, substantial customer records, personnel files or payment information. Contracts, cyber insurance, clients or sector rules may also require multi-factor authentication. The precise legal assessment depends on the case.
Document the systems, method, activation date, recovery process and revocation process. This helps with internal reviews, insurance questionnaires and incident response.
What belongs in a 2FA recovery plan?
Define who to contact after device loss, how a factor is blocked, where spare keys are stored and who may verify a person’s identity. At least two authorised people should be able to recover critical company accounts without sharing the same daily key.
Test recovery after staff or device changes. Remove old phones, numbers, app links and keys, and review active sessions because a password change does not end every existing session automatically.
After suspicious activity, change the password from a trusted device, revoke unknown sessions and factors, and inspect forwarding rules, roles and recovery addresses. Record the timeline and assess whether personal data and GDPR notification duties are involved.
Frequently asked questions about 2FA
Is SMS 2FA enough for a small business?
It is usually better than a password alone, but authenticator apps, passkeys or hardware keys are preferable for critical accounts.
What happens if the 2FA phone is lost?
Block the factor and use tested recovery codes, a replacement device or a second authorised administrator.
Should every employee have an individual account?
Yes. Personal accounts provide accountability and can be disabled separately.
Can attackers bypass 2FA?
Yes, through phishing, stolen sessions or careless push approval. FIDO2 methods reduce phishing risk.
Where should recovery codes be stored?
Encrypted or physically protected, with controlled access and separate from the everyday phone or laptop.