Small Business Identity and Access Security Guide: Essentials on a Budget

Most small businesses are compromised through an account, not a firewall: a reused password on email, a payroll login without two-step verification, or an administrator account used for everyday browsing. The good news is that the controls that stop most of these attacks are already included in the cloud services small firms pay for, and the main cost is time. This guide sets out the identity and access essentials for organisations with roughly 1 to 250 staff, in the order to do them, with the settings in Microsoft 365 and Google Workspace, the Cyber Essentials v3.3 requirements and the CISA and NCSC guidance for small organisations. It is written for owners, office managers, the person who "does IT", and the managed service providers (MSPs) who support them. It does not cover the SMB file sharing protocol; for port 445, SMB signing and SMBv1, see the Network Ports and Protocols Security Guide.

Key takeaways

• Turn on MFA everywhere it exists. Under Cyber Essentials v3.3, failing to use MFA on any cloud service that offers it is an automatic fail, and CISA tells small businesses to enforce it technically rather than ask nicely.
• Prefer passkeys. The NCSC recommends enabling passkeys first on business-critical accounts, because they cannot be phished; any 2-step verification is still better than none.
• Separate admin from everyday use. Nobody should read email or browse as an administrator, and staff laptops should not have local admin rights.
• Leavers are the cheapest fix. Remove former staff, contractors and suppliers on their last day and review who has access to key accounts every few months.
• Know which accounts would sink you. Banking, payroll, email, domain hosting and the account that controls all the others deserve the strongest protection and a recovery plan.

Which accounts matter most

The NCSC advises small organisations to focus first on accounts that hold customer or staff information, or whose loss would seriously disrupt the business. A simple register, kept in a spreadsheet or the password manager, is enough.

Multi-factor authentication and passkeys

Cyber Essentials Requirements for IT Infrastructure v3.3 apply to assessment accounts created from 27 April 2026. According to IASME, MFA is now mandatory on all cloud services where it is available, including free and bundled services, and missing it on any one of them is an automatic fail; cloud services cannot be excluded from scope. The update treats FIDO2 passkeys as MFA and names passkeys as the NCSC's preferred default.

CISA's small business guidance says FIDO authentication is the only widely available phishing-resistant option and that any MFA is better than none. It also warns that enrolment gaps appear with new hires and staff who change phones, so check coverage regularly. See the Passwordless and Passkeys Guide and the Passkey Rollout Guide.

Microsoft 365

• Security defaults: free for every tenant and on by default for tenants created since 22 October 2019. They require all users to register for MFA, require MFA on every sign-in for administrator roles such as Global Administrator, Exchange Administrator and Helpdesk Administrator, block legacy authentication (IMAP, POP3, SMTP basic authentication) and block device code flow. Turn on under Entra ID, Overview, Properties, Manage security defaults.
• When to move to Conditional Access: security defaults are on or off with no exceptions. Conditional Access needs Microsoft Entra ID P1 (included in Microsoft 365 Business Premium) and lets you require compliant devices, block countries or demand phishing-resistant methods for admins. You must switch security defaults off before Conditional Access policies replace them.
• Before enabling: check no admin relies on legacy authentication, and revoke existing sessions (Microsoft documents Revoke-MgUserSignInSession) so users must register.
• Emergency access: Microsoft recommends two cloud-only break-glass accounts with Global Administrator, not tied to a person, with long passwords and security keys stored securely.

See the Microsoft 365 Security Guide.

Google Workspace

• Enforcement: under Security, Authentication, 2-step verification, allow users to enrol, track enrolment in the Security report, then set an enforcement date (enforcement starts 24 to 48 hours after it).
• New user grace period: can be up to six months, during which new accounts sign in with a password alone. Keep it short, a week or less.
• Allowed methods: "Only security key" now also accepts passkeys and is the right setting for admins. The option that allows any method except text or phone-call codes removes the weakest option for everyone else.
• Exceptions: a temporary group without enforcement is possible, but Google says it is not a recommended standard practice; give it an owner and an end date.

See the Google Workspace Security Guide.

Passwords and password managers

• Unique for every account: the NCSC says to use a strong password not reused anywhere else and to change reused passwords on business-critical accounts as soon as possible. Reuse is what credential stuffing (T1110.004) exploits.
• Length over rules: the CISA and FBI Scattered Spider advisory recommends unique, random passwords of 16 to 64 characters, password managers, account lockout after failed attempts and no forced periodic changes.
• Business password manager: gives each person a vault, lets you share the few accounts that really must be shared without revealing the password, and lets you revoke access when someone leaves. See the Password Manager Buyer's Guide.
• Protect the password manager itself: the vault account needs its strongest MFA and an agreed recovery route, because losing it locks you out of everything.
• Shared logins: where a supplier only offers one login, keep it in the shared vault, record who used it, and change it when anyone with access leaves.

Administrator accounts and least privilege

The NCSC advises not using the main administrator account for daily work, and CISA advises removing administrator rights from user laptops because that blocks many malware installs. Valid Accounts (T1078), especially cloud accounts (T1078.004), is how attackers turn one stolen login into control of the business.

• Two accounts for whoever runs IT: an everyday account with no admin rights and a separate admin account used only for administration, with a security key.
• As few global admins as possible: two or three, not every director. Use narrower roles (user administrator, billing administrator) for everyday tasks.
• No local admin on laptops: install software through device management (Intune, Google endpoint management or the MSP's tooling), not by giving staff admin passwords.
• Owner accounts: the owner often holds the top account for the bank, domain and Microsoft or Google tenant. Make sure a second trusted person can recover them.

Joiners, movers and leavers

Small firms rarely have identity governance tools, so a written checklist does the job. The NCSC asks small organisations to remove or disable accounts for staff, suppliers and contractors who have left, and to review who has access to important accounts every few months.

Suppliers, MSPs and remote access

• MSP access: an MSP that manages your tenant holds the keys to it. Ask for named technician accounts, MFA on their own tools, least-privilege delegated roles and a list of who can reach you. In Microsoft 365, granular delegated admin privileges (GDAP) replace broad legacy delegated rights. See the GDAP and MSP Delegated Admin Access Guide.
• Remote access tools: attackers use legitimate remote support tools (Remote Access Tools, T1219). Allow only the one your MSP uses, with MFA on its console, and remove the rest. See the RMM Tool Security Guide.
• Remote desktop and VPN: never expose RDP directly to the internet. Any VPN or remote desktop gateway needs MFA; the Change Healthcare breach 2024 began with a stolen password on a remote access portal that did not require MFA.
• Help desk calls: if your MSP resets passwords on request, agree how they will confirm it is really you, for example a call back to a known number.

Email, invoices and payment fraud

For small firms the most common loss from an account takeover is a changed bank detail on an invoice. Identity controls stop the takeover; process controls stop the payment.

• Verify bank detail changes out of band: phone the supplier on a number you already hold, never one from the email.
• Watch mailbox rules: attackers who get into a mailbox often create forwarding (T1114.003) or hiding rules (T1564.008). Check for new rules and external forwarding.
• Protect your domain: publish SPF, DKIM and DMARC so others cannot easily send email as you. See the DMARC, SPF and DKIM Guide.

See the Email Identity and BEC Guide.

A 90-day plan on a small budget

1. Week 1: write the account register above, name an owner for security (CISA calls this a Security Program Manager, but in a small firm it may be the office manager) and agree monthly check-ins with the director.
2. Weeks 1 to 2: turn on MFA for every admin account, using security keys or passkeys. Create Microsoft break-glass accounts if you use Microsoft 365.
3. Weeks 2 to 4: announce a date, help staff enrol, then enforce MFA for everyone (security defaults or Google 2SV enforcement). Test with two or three people first; if something breaks, rollback is switching enforcement off for a named group with an end date.
4. Weeks 3 to 6: roll out a business password manager, starting with shared accounts, and change every reused password on the critical list.
5. Weeks 4 to 8: remove leavers and unknown accounts, separate admin accounts, remove local admin from laptops.
6. Weeks 6 to 10: review MSP and supplier access and remote access tools; enable MFA on VPN or remote desktop.
7. Weeks 8 to 12: check every other cloud service for MFA (Cyber Essentials v3.3 needs it wherever available), run a 30-minute tabletop of "the director's email is taken over", and plan Cyber Essentials certification. See the Cyber Essentials Guide.

Decision guidance

• Security defaults or Conditional Access: under about 20 staff without Business Premium, security defaults give most of the protection at no cost; with Business Premium or a need for exceptions, use Conditional Access.
• Do it yourself or use an MSP: a firm with a capable staff member can do the 90-day plan in house; otherwise pay an MSP but make the plan and the metrics part of the contract.
• Passkeys or authenticator app: passkeys first where supported; the authenticator app with number matching fills the gaps.
• Micro business or 200 staff: a sole trader needs passkeys, a password manager and backup codes; a firm of 200 needs device management, Conditional Access, quarterly reviews and a documented leaver process.

Detection and measurement

• Watch: sign-ins from new countries, MFA method changes, new admin role assignments, new mailbox rules, new OAuth app consents and failed sign-in spikes. Microsoft 365 and Google Workspace both email alerts for many of these if you turn them on.

Framework mapping

For organisations outside the UK, NIST SP 1300, the CSF 2.0 Small Business Quick-Start Guide, is the equivalent starting point, and CIS Controls v8.1 Implementation Group 1 sets out a similar baseline (for example Safeguards 5.3 disable dormant accounts and 6.3 to 6.5 MFA for externally exposed applications, remote access and administrative access).

Common failure patterns

• MFA on email, nowhere else: payroll, accounting and the domain registrar left on password only, which Cyber Essentials v3.3 now fails.
• Everyone is an admin: directors, the office manager and the MSP all hold global admin, and nobody uses a separate account.
• Exceptions that never end: the director excluded from MFA "temporarily", or a Google exception group with no end date.
• Leavers keep access: former staff still in the shared vault or on the social media account, and an old agency still holding the website admin login.
• Remote access without MFA: an old VPN or RDP port that predates the cloud move, as in the Change Healthcare breach.
• No recovery plan: the only person who can sign in to the tenant or the bank leaves or loses their phone.

Practitioner checklist

• Keep a register of critical accounts with an owner and the MFA method for each.
• Enforce MFA for all users, with passkeys or security keys for every administrator.
• Block legacy authentication in Microsoft 365, or remove text and voice codes in Google Workspace.
• Roll out a business password manager and remove reused passwords from critical accounts.
• Give IT staff separate admin accounts and remove local admin rights from laptops.
• Disable leavers on their last day and review admins, guests and connected apps every quarter.
• Limit MSP and supplier access to named accounts with MFA and allow only one remote support tool.
• Require MFA on any VPN or remote desktop and never expose RDP to the internet.
• Confirm supplier bank detail changes by phone to a known number.
• Create break-glass or recovery arrangements so a second person can regain control.

Standards and references

• NCSC: Small Business Guide, Secure your important online accounts
• IASME: Upcoming Changes to the Cyber Essentials Scheme, April 2026 Update
• CISA: Cyber Guidance for Small Businesses
• NIST: SP 1300, CSF 2.0 Small Business Quick-Start Guide
• Microsoft Learn: Security defaults in Microsoft Entra ID
• Google Workspace Admin Help: Deploy 2-Step Verification
• CISA and FBI: Scattered Spider Cybersecurity Advisory AA23-320A
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: Cyber Essentials Guide · MFA Guide · Microsoft 365 Security Guide · Password Manager Buyer's Guide · Retail and E-Commerce Identity Security Guide