Free business safety checklist
Protect your passwords and MFA
One account. One strong password. No surprise approvals.
For staff protecting work accounts, passwords and multifactor authentication (MFA).
Download the A4 PDF1 page · A4 portrait · PDF · 234 KB · No signup required
Five checks to use at work
- Use a unique passwordUse a strong password for each account, stored in an organisation-approved password manager.
- Choose a strong passphraseUse at least 15 characters and four or more random words for a memorable passphrase.
- Enable MFAAsk IT about phishing-resistant passkeys or security keys.
- Approve only your sign-insOnly approve sign-ins you initiated with matching details. Deny and report unexpected prompts.
- Protect passwords and codesKeep passwords, verification and recovery codes private. Use your usual app or a trusted bookmark.
Shared a password or approved a suspicious request?
- Contact IT urgently.
- Reset affected and reused passwords from a trusted device.
- IT should revoke sessions and review MFA, recovery settings and mailbox rules.
Sources and further reading
- ACSC: practical tips for business leaders
- ACSC: personal cyber security handbook
- ACSC: recover from business email compromise
Primary guidance checked in October 2026. Your organisation’s procedures and IT team should guide the response to a real incident.