Require multifactor authentication (MFA) for employee access to business systems, favor phishing-resistant sign-in methods, and limit each account to the access its user needs. Roll these controls out together: MFA can make a stolen password less useful, while least privilege limits the damage an account can do if it is compromised. Secure enrollment, recovery, monitoring, and offboarding are part of the same job.
1. Inventory accounts and the systems they can reach
Start with a list of identities and the services they use. Include employees, contractors, administrators, service accounts, and emergency accounts. Map each identity to the systems where it authenticates, rather than assuming that securing the main company login covers every route in.
As an Amazon Associate I earn from qualifying purchases.
At a minimum, check email, remote access and VPN, file sharing, the identity provider, cloud consoles, finance systems, and business applications. Record which systems can enforce MFA and identify local accounts, legacy protocols, alternate credentials, and recovery routes that might bypass the primary sign-in policy. For a system that cannot enforce MFA, assign an owner and a mitigation or replacement plan.
2. Require MFA across employee access
Make MFA a default requirement through the identity provider and application settings; do not leave it as an employee opt-in. Prioritize administrator accounts and employees handling sensitive information during the initial rollout, then extend enforcement to all users and services. Include remote and third-party access.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Verify enforcement at each application, including local and legacy sign-ins. A strong primary login is not enough if an alternate protocol, app-specific password, or recovery flow offers an easier path into the same account. CISA’s small-business MFA guidance puts the rationale plainly: “Strong passwords help, but they are no longer enough to keep accounts and systems safe when used alone.”
3. Choose MFA methods for security and fit
MFA methods do not offer equal protection. Prefer FIDO/WebAuthn security keys or platform authenticators where the identity provider, applications, and employee devices support them. These cryptographic methods are designed to resist credential phishing. CISA describes security keys as providing “the best protection against phishing and [being] easy to use”; that is CISA’s characterization, not a product test. NIST SP 800-63B Revision 4 also states, “Passwords are not phishing-resistant.”
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Method | Phishing and takeover considerations | Practical deployment checks |
|---|---|---|
| FIDO/WebAuthn security key or platform authenticator | Phishing-resistant when correctly supported and configured. | Confirm identity-provider and app support, operating-system and browser compatibility, device connectors or NFC needs, accessibility, enrollment, backup authenticators, and recovery. A physical FIDO2 key may suit the environment; CISA names YubiKey as an example, but no specific model is established here. |
| Number-matching push | Useful interim protection against indiscriminate push-approval prompts, but not a substitute for phishing-resistant MFA. | Check application support and provide a transition plan to a phishing-resistant method where possible. |
| Authenticator-app one-time code | A practical option, but codes can be phished. | Consider compatibility, employee usability, enrollment and recovery burden, and how users can register a backup authenticator. |
| SMS or voice code | Weaker than the options above; reserve it for accounts where stronger methods are unavailable. | Document why it is needed and whether the account can move to a stronger method. |
Assess each method against phishing resistance, compatibility with the organization’s identity provider and device fleet, accessibility, employee usability, recovery and redundancy, and support effort. If issuing physical keys, check ports and connectors, NFC requirements, spare-key policy, and account recovery before choosing a model. A key purchase alone does not secure an account or limit its permissions.
4. Separate routine accounts from administrator accounts
Employees should use standard accounts for email, browsing, and routine business work. Administrators should have separate privileged identities reserved for administrative tasks; ordinary accounts should not have administrator-level privileges by default. This reduces the privileges exposed during routine use and follows CISA’s guidance on separating user and privileged accounts.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Where the environment supports it, grant elevated rights only when needed and for a limited period, then remove or disable them. Do not use a privileged identity for everyday browsing or email.
5. Grant access by role and review it regularly
Define roles around job duties and give each role only the access its work requires. Restrict sensitive data and administrative functions to people who need them. Apply the same discipline to contractors and vendor access: scope permissions to the work, and set an end date or review point.
Rank #4
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Review permissions on a recurring schedule and after a role change, departure, or vendor relationship change. Remove unused and stale accounts, monitor active accounts, and maintain a controlled emergency-access process for exceptional situations. CISA’s #StopRansomware Guide discusses IAM for managing roles and privileges and recommends least privilege and separation of duties in third-party access.
Free tools Windows power users keep installed
One-click scans. No signup required.
6. Secure enrollment, recovery, and offboarding
Plan the account lifecycle alongside MFA deployment. Document how identities are verified at enrollment, how authenticators are issued and bound to accounts, how lost or stolen devices are reported, how replacements and recovery work, how roles change, when contractor access expires, and how employee access is removed.
Best Value
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Protect recovery material and test the recovery procedure. Recovery should not be an easier way around MFA: make sure it verifies the person appropriately and invalidates lost or stolen authenticators. NIST SP 800-63B Revision 4 addresses authenticator binding and invalidation after loss or theft; its requirements are written for digital identity services and are not, by themselves, a universal legal mandate for every private company. Choose operational controls that fit the organization’s identity service, data, and threat model.
7. Measure coverage, gaps, and exceptions
Track whether controls are actually enforced, not just whether a policy exists. Useful measures include:
- MFA enforcement by application and account class.
- Adoption of phishing-resistant methods.
- Privileged accounts without a separate standard-user identity.
- Unresolved legacy-system exceptions, each with an owner and remediation plan.
- Dormant accounts and completion of scheduled access reviews.
There is no single published statistic established here for the effect of this exact combined rollout. Use your organization’s own coverage and incident measures rather than borrowing a percentage from a different population or control. CISA’s administrator-focused Identity and Access Management recommendations can help inform how roles and authentication are managed.
Tailor the policy to your organization
This is general U.S.-oriented cybersecurity guidance, not a determination of legal or regulatory duties. Set requirements according to the sensitivity of the data, the services in use, applicable rules, and the organization’s threat model. Confirm that every targeted application enforces the intended policy, including its legacy and recovery paths.
For technical detail on phishing-resistant deployment, see CISA’s Implementing Phishing-Resistant MFA factsheet, dated October 2022. For authenticator and recovery requirements, consult NIST SP 800-63B Revision 4, whose page displayed an update timestamp of August 26, 2025.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
