MFA for small organizations: which method to choose first

Turn on whatever multi-factor authentication you can today, because CISA says any MFA is better than none. Then move toward phishing-resistant methods, with FIDO or WebAuthn security keys and passkeys as the target, starting with email and admin accounts.

What MFA is

MFA combines factors from different categories: something you know, such as a password; something you have, such as an authenticator app or a text message code; and something you are, such as a fingerprint or face scan.

If an attacker steals a password, they still cannot meet the second factor.

The methods, roughly strongest to weakest

CISA ranks MFA types in a hierarchy, and that page is archived, so check its current guidance as well. In plain terms:

1. FIDO and WebAuthn (security keys, passkeys): block logins to fake websites. CISA names this as the phishing-resistant standard.
2. Authenticator app with number matching: stops many push bombardment attacks.
3. Authenticator app codes and push approvals.
4. Text or voice codes: weakest of the common options, open to SIM swapping and interception, but still far better than nothing.

A decision guide

Do you have under 20 people and shared devices? Start with authenticator apps for everyone, and issue security keys to the two or three people with admin rights.

Do you have students? Check your platform's options. Younger students may not have phones, so rely on device and network controls and protect staff accounts with the strongest method.

Do volunteers need access? Give them the least access needed and consider a shared account only with a manager that supports team sharing. Do not share one login and one text number.

Rollout order

1. Email administrators.
2. All email accounts.
3. Donor and student information systems.
4. Finance and payroll tools.
5. Website admin.
6. Everything else.

Make each step a deadline, not a suggestion. Provide recovery codes and store them safely, or people will lock themselves out and push to turn MFA off.

Plan for lost phones

Decide in advance how identity is verified for a reset. A reset process that accepts an email from the "user" gives attackers a way around MFA.

Quick check

Sources

• CISA: Multi-factor authentication
• CISA: Ransomware guide

Last reviewed: 19 October 2026.