Email often sits at the centre of digital life. It receives password resets, invoices, shared documents and access invitations. Begin your account security work there, then consider the services that control money, administration and business records. A short list of important accounts is easier to act on than a vague instruction to secure everything at once.
Choose stronger ways to sign in
Where a service supports them, phishing-resistant sign-in methods such as FIDO security keys and passkeys can reduce exposure to stolen credentials and deceptive sign-in pages. Check the provider’s official setup instructions and recovery options. If those methods are unavailable, enable the strongest suitable multifactor authentication the service provides; a password alone should not be the long-term plan for an important account.
Make the account inventory useful
List each important account, its owner and the person who can help recover it.
Use a different strong password for each password-based account; a reputable password manager can make this practical.
Prioritise email, administrator accounts and remote access before less important services.
Remove accounts and access that are no longer needed, including access left behind after staff changes.
Review sign-in alerts and reject approvals you did not initiate.
Plan recovery while you still have access
A security improvement is incomplete if nobody knows what happens when a phone is lost or a staff member leaves. Store recovery material in a secure place appropriate to the account, separate from everyday messages and public documents. For a team, document the authorised recovery route and avoid making a single personal device the only way to regain administrative access. Test the procedure with a low-risk account first.
Try a one-week account review
Choose three important accounts this week. On the first day, identify their owners and sign-in options. Next, improve one account at a time and verify that normal work still functions. Finish by reviewing recovery details and recording the date of the check. This gives your team a repeatable task instead of a one-off reminder.
Further reading
FBI: Improving cyber resilience, including phishing-resistant authentication
Here to help
Something doesn’t look right?
Prepare an incident report with the details that matter.