MFA and Password Policy for Small Teams in Uganda

If you do only one thing to improve your business security this month, make it this: turn on multi-factor authentication and fix how your team handles passwords. It costs little, takes about an hour for a small team, and blocks a large share of the account takeovers that businesses suffer.

What MFA is, in one minute

A password is something you know. Multi-factor authentication (MFA) adds a second proof, usually something you have, such as your phone. Even if a criminal steals or guesses your password, they still cannot get in without that second step.

Common second factors, from strongest to weakest in general:

1. Hardware security keys or passkeys: very strong, resistant to phishing.
2. Authenticator apps that generate a code or send an approval prompt: strong and free.
3. SMS codes: better than nothing, but weaker, because phone numbers can be hijacked or SIM-swapped.

For most small businesses, an authenticator app is the right starting point.

Turn MFA on in this order

Not every account matters equally. Start where a breach would hurt most.

1. Email accounts, especially owners, directors and finance. Email lets attackers reset other passwords.
2. Cloud storage and productivity suites (Microsoft 365, Google Workspace and similar).
3. Banking and mobile money portals and any payment or accounting software.
4. Remote access, such as VPN and remote desktop.
5. Admin accounts for websites, domains, social media, routers, firewalls and CCTV systems.
6. Everything else that offers it.

A one-hour rollout plan

Minutes 0 to 10: Prepare. List the systems above and who uses them. Choose one authenticator app for the whole team so support is simple. Tell staff what is happening and why.

Minutes 10 to 30: Admins and leaders first. Enable MFA on owner, director, finance and IT administrator accounts. Save the recovery codes and store them somewhere safe, such as a sealed envelope in a locked cabinet or an encrypted password vault.

Minutes 30 to 50: Everyone else. Walk staff through setup in a short group session. Having people enrol together is faster than chasing them one by one.

Minutes 50 to 60: Test and document. Have two or three people sign out and back in. Write down where recovery codes are kept and who can reset MFA for a staff member who loses a phone.

What about staff who lose or change phones?

Plan for this before it happens:

• Keep recovery codes for admin accounts stored securely.
• Decide who can verify a person's identity and reset their MFA, and how.
• Ask staff to move their authenticator to the new phone before wiping or handing in the old one.
• Do not reset MFA on a request by email or chat alone. Confirm by calling the person on a known number or in person.

Password policy that people can actually follow

Older advice, such as forcing complicated passwords that change every 30 days, often made things worse, because people responded with predictable patterns like adding a number each month. Current good practice is simpler:

• Length over complexity. Aim for passphrases of 12 to 16 characters or more, such as several unrelated words.
• Unique everywhere. Never reuse a password between work and personal accounts, or between systems.
• Use a password manager. It generates and stores strong passwords so staff do not have to remember them or write them down.
• Block known bad passwords. Many systems can reject common or previously breached passwords.
• Change when there is a reason, such as a suspected breach or a departed employee, rather than on a fixed rotation.
• No sharing. Each person has their own login. If a shared account is unavoidable, use a password manager's sharing feature and keep a record of who has access.

Why a password manager is worth it

A password manager removes the biggest practical barrier to good passwords. Staff remember one strong passphrase and the manager does the rest. Business versions let you share credentials securely, see which accounts have weak or reused passwords, and remove access when someone leaves.

When choosing one, check that it supports MFA on the vault itself, works on the phones and browsers your team uses, and offers an admin view for business accounts.

A one-page policy you can adopt today

Copy and adapt this:

• Everyone uses their own account. No shared logins.
• MFA is required on email, cloud services, finance systems and remote access.
• Passwords are long, unique and kept in the company password manager.
• Recovery codes for admin accounts are stored securely by [name or role].
• Lost or replaced phones are reported to [name or role] on the same day.
• When someone leaves, their accounts are disabled the same day.
• Suspicious login prompts or messages are reported immediately.

Beware of MFA fatigue and fake prompts

Attackers sometimes spam approval prompts hoping someone taps "approve" just to make them stop, or they trick people into reading out a code. Tell staff:

• Never approve a prompt you did not start.
• Never read out or forward a verification code, even to someone claiming to be IT.
• If prompts arrive unexpectedly, report it. It may mean the password is already compromised.

Need a hand rolling it out?

If you would rather not do this alone, Backspace can set up MFA, a password manager and access controls across your email, cloud and network systems as part of our IT support and managed IT services. Book a free site assessment and we will review what is protected and what is not.

Book a free site assessment or call +256 786 394 913.