Two-step sign-in rollout for a small team: which accounts first and how to handle lost phones

A password alone is a weak lock. It can be guessed, reused, leaked by another service or typed into a fake page. A second step, such as a code from an app or a security key, means a stolen password is no longer enough.

Most small teams know this and still have not done it, usually because the rollout feels risky: what if someone loses a phone and cannot work? This article gives a plan that answers that question first, so the rollout does not stall.

Which accounts first

Do not try to protect everything at once. Go in this order, because the damage from a takeover grows with each step:

1. Email. Whoever controls a mailbox can reset the password of almost every other account. Start here, for every person.
2. Money. Online banking, payment providers, invoicing and accounting. Banks often require a second step already; check the others.
3. Administration. Domain registrar, website hosting, cloud consoles, the admin account of your office suite and the password manager (see a password manager rollout for a small company).
4. Everything else. Project tools, CRM, social media and any tool that holds customer data.

If you keep a list of tools and who uses them, as suggested in the annual access cleanup day, add one column: "second step on?". That column is your rollout tracker.

Choose one method for the whole team

Pick one default so that people can help each other. In order of preference:

• Security key or passkey for administrators and the owner. Hard to fool with a fake page.
• Authenticator app for everyone else. Free, works offline and is easy to explain.
• Text message codes only where nothing else is offered. Better than nothing, but weaker.

A one-week rollout

• Day 1: decide. Choose the default method, the order of accounts and one person who helps others. Tell the team what changes and why, in five minutes.
• Days 2–3: set up together. Sit with each person for ten minutes, ideally in a shared slot. Switch it on for email first. Do not send instructions and hope; most failures happen when people are alone with a setup screen.
• Day 4: money and administration. Repeat for the second and third group.
• Day 5: backup codes and check. Make sure every account has backup codes stored (next section), and tick off the tracker column.
• The week after: ask each person to sign in once from a new browser, to prove they can.

Backup codes

Most services give you a list of one-time backup codes when you switch on the second step. These are the way back in when the phone is gone.

• Save them in the password manager, in a shared vault where at least two people can open them. For personal accounts, each person keeps their own, with the owner holding a sealed copy for critical accounts.
• Do not store them only on the same phone that creates the codes.
• When a code is used, generate a new set.

Administrator accounts should also have a second administrator. If the only admin loses a phone, a second one can reset the access instead of waiting for provider support.

What to do when a phone is lost

Write these steps on one page before anyone needs them:

1. Tell the helper immediately, even at night. A short message is enough.
2. Lock or wipe the phone using the built-in find-my-device feature.
3. Sign in with a backup code on another device and register the new phone as the second step.
4. Remove the old phone from each account's list of devices, starting with email.
5. Change the passwords of the most important accounts if the phone had no screen lock.
6. Note it in the tracker with the date.

Practise this once with a test account. The first time should not be a real emergency.

Exceptions, with an end date

Some accounts cannot use a second step: a shared mailbox, an old device, a tool with no support. Do not leave them forgotten. For each exception write down:

• the account and the owner;
• the reason;
• what limits the risk meanwhile, for example a very long unique password and fewer people who know it;
• an end date, no more than three months away, when it is reviewed.

An exception without an end date quietly turns into the permanent state of things.

Common mistakes

• Starting with the least important tool. Email and administration come first.
• Keeping the only codes on one phone. Without backup codes, a lost phone locks the person out.
• Leaving out the owner. The most powerful accounts are often the ones left until last.
• No check. Switching it on is not the same as proving that a person can sign in.
• Forgetting leavers. When someone leaves, remove their devices too (see the new employee access checklist).

Summary

Protect email first, then money and administration. Choose one method, set it up together in one week, store backup codes where two people can reach them, write the lost-phone steps on one page and give every exception an end date. The work is a few hours in total, and it removes the most common way a small company loses control of its accounts.

Sources

• Common practice for small businesses, offered as a practical guide. No client results or market figures are claimed in this article. The one-week schedule and the three-month exception limit are examples; adjust them to the size of your team.