# An account security checklist for teams of 2 to 20

> A 15-step account security checklist for a team of two to 20, built from UK, Australian, Canadian, and US guidance, with the MFA and password rules explained.

This **account security checklist** gathers what the official guides of the UK, Australia, Canada, and the US ask small businesses to do, in 15 steps you can assign and date. Its core: one account per person, multifactor authentication everywhere, phishing-resistant sign-in for administrators, separate admin accounts, regular access reviews, and access removed when someone leaves.

**Key takeaways**

1. Australia's ASD suggests starting with three measures: turn on multifactor authentication, keep software up to date, and back up data regularly.
2. NIST says organizations should enforce, or at least offer, phishing-resistant authentication for sensitive applications and administrator accounts.
3. Cyber Essentials in the UK and Canada's baseline controls both advise against forcing regular password changes when there is no sign of compromise.


## A small business cyber security checklist for your accounts

Work through these 15 steps with the person who owns security in your team, and write a name and a date next to each. They apply the rules of [securing a small team's accounts](/guides/account-security/team-security/) and come from the free guidance of four governments; the US version closest to this list is the NIST [quick-start guide for small businesses](https://www.nist.gov/itl/smallbusinesscyber/quick-start-guides) to its Cybersecurity Framework 2.0.

Each step names the agencies that recommend it: the NCSC in the UK, the Australian Signals Directorate (ASD), the Canadian Centre for Cyber Security (Cyber Centre), and, in the US, CISA, NIST, and the FTC. The list is our synthesis, not an official one, and no agency publishes this exact order.

### The 15 steps

| # | Step | Recommended by | Owner and date |
|---|---|---|---|
| 1 | Name one person responsible for account security, and tell the team who it is | Cyber Centre, Get Cyber Safe | |
| 2 | List every business account (email, bank, payroll, cloud storage, website and domain, social media, point of sale) and who can use it | NCSC, ASD, CISA | |
| 3 | Secure email first: passkeys where offered, otherwise a strong password plus two-step verification | NCSC, ASD | |
| 4 | Turn on multifactor authentication (MFA) on every account that offers it, starting with email, banking, cloud storage, accounting, and social media | ASD, NIST, NCSC | |
| 5 | Require phishing-resistant MFA, such as passkeys or security keys, for administrators and sensitive accounts | NIST, CISA, ASD | |
| 6 | Give everyone a password manager, with long, unique passwords and MFA on the manager itself | NCSC, ASD, NIST, Cyber Centre | |
| 7 | Create one account per person; list the shared accounts that remain and who uses them | ASD, Cyber Centre, NCSC | |
| 8 | Keep administrator accounts separate, with no email or browsing, and use a standard account for daily work | NCSC, Cyber Centre, ASD | |
| 9 | Review who has access to what every few months, and give each person only the access they need | NCSC, ASD, Cyber Centre, CISA | |
| 10 | When someone leaves or changes role, disable their accounts, remove their rights, and change the shared credentials they knew | NCSC, ASD, Cyber Centre, CISA | |
| 11 | Turn on automatic updates, apply critical fixes within 14 days, and replace unsupported software and devices | NCSC, CISA | |
| 12 | Back up automatically, and test that you can restore | ASD, CISA, NIST | |
| 13 | Train everyone when they join and regularly after that: phishing, passwords, and how to report | FTC, ASD, Cyber Centre | |
| 14 | Verify any payment request or change of bank details through a channel you already trust | ASD | |
| 15 | Write an incident plan (who to call, where to report, a copy kept offline) and rehearse it at least once a year | CISA, ASD, NCSC | |

The 14-day deadline in step 11 comes from Cyber Essentials, which applies it to updates rated critical or high risk.

### If you only have one afternoon

Start where the ASD starts. Its [small business handbook](https://www.cyber.gov.au/publication/small-business-cyber-security-handbook/securing-accounts-and-identities), published on October 7, 2026, recommends three measures before anything else: turn on MFA, keep software up to date, and back up data regularly. In checklist terms, that is steps 3, 4, 11, and 12. NIST's guide adds a starting list for MFA: banking, accounting and tax, merchant accounts, and your Google, Microsoft, or Apple accounts.

### Which MFA for whom

- **Everyone:** any second factor is better than none, as the NCSC puts it. The ASD calls a code by text message or email the least secure option, so prefer an authenticator app or a passkey when the service offers one.
- **Administrators and sensitive accounts:** NIST says organizations should enforce, or at least offer, phishing-resistant authentication there. CISA notes that FIDO/WebAuthn, the standard behind passkeys and security keys, is the only widely available phishing-resistant method; Cyber Essentials counts FIDO2 passkeys as MFA.
- **Cloud services in the UK:** if you aim for Cyber Essentials, its version 3.3 requirements say authentication to cloud services must always use MFA.

### Passwords: the guides disagree on length

Where a password remains, the official minimums differ:

| Guide | Minimum length |
|---|---|
| ASD small business handbook (Australia) | 15 characters without MFA; with MFA, as long as possible and at least six |
| Cyber Essentials v3.3 (UK) | 12 characters without MFA, or eight with a blocklist of common passwords; eight with MFA |
| FTC (US) | 12 characters, a passphrase is fine |
| Get Cyber Safe (Canada) | 12 characters, a passphrase preferred |

Our recommendation, which satisfies all four: a passkey where the service supports one, otherwise a password of 15 characters or more generated by the team's password manager. Two of the guides also agree on what not to do: Cyber Essentials and Canada's baseline controls advise against forcing regular password changes, and keep changes for a suspected compromise.

### Where these steps come from

Each country's guide has its own scope, price, and certification. Our comparison of [Cyber Essentials, the Essential Eight, and their counterparts](/guides/account-security/team-security/government-guidance/) explains which one fits your business.

### Step 10, in detail

Departures are where small teams most often leave doors open. See [the accounts and codes to recover when someone leaves](/guides/account-security/team-security/offboarding/).

### Step 13, for free

You do not need a budget to train a team of five. Our list of [free training courses for staff](/guides/account-security/team-security/security-training/) starts with a 30-minute module.