A compromised Microsoft 365 account can expose invoices, payroll records, client files, and years of email in a matter of minutes. That is why business leaders increasingly ask, is MFA mandatory? The short answer is: sometimes by rule, often by contract, and almost always as a practical security control.
Multi-factor authentication, or MFA, requires users to prove their identity with more than a password. That could mean approving a prompt in an authenticator app, using a security key, or entering a code. For small and mid-sized businesses, MFA is one of the most effective ways to reduce the damage caused by stolen passwords.
Is MFA Mandatory for Every Business?
There is no single U.S. law requiring every private business to use MFA across every account. A local manufacturer, law firm, medical practice, and accounting firm may all face different obligations based on the data they hold, the systems they use, and the contracts they have signed.
That said, the absence of one universal law should not be mistaken for a free pass. MFA may be required by an industry rule, a customer agreement, a cyber insurance policy, a government contract, or a software provider's terms. Even when it is not specifically named, regulators and auditors may view MFA as a reasonable safeguard for protecting sensitive information.
For most organizations, the more useful question is not just whether MFA is legally mandatory. It is whether the business can reasonably defend its decision not to use it after an account takeover, ransomware incident, or failed compliance review.
When MFA Is Required by Compliance Rules
Requirements depend on your industry and the information your business handles. Some frameworks state MFA requirements directly. Others use broader security language that can still make MFA the sensible and expected control.
Organizations processing payment card data must follow PCI DSS. MFA requirements apply to access into the cardholder data environment and to remote access that could reach it. The exact scope matters, so businesses should identify where card data exists and which users, vendors, and systems can reach those environments.
Financial organizations subject to the FTC Safeguards Rule must use multi-factor authentication for anyone accessing customer information, unless they use equivalent controls that are approved in writing by a qualified individual. In practical terms, most affected firms should treat MFA as a baseline requirement rather than look for exceptions.
Healthcare is more nuanced. HIPAA does not simply state that every account must use MFA. The HIPAA Security Rule requires appropriate administrative, physical, and technical safeguards based on risk. Because email, cloud file storage, remote access, and electronic health record platforms are common targets, MFA is frequently the reasonable choice for protecting electronic protected health information.
Defense contractors and organizations supporting federal work may also face MFA requirements through contract clauses, CMMC expectations, or the security standards required by their customers. MFA is particularly relevant for privileged accounts, remote access, systems handling controlled unclassified information, and cloud platforms used for contract work.
State rules can add another layer. For example, organizations subject to New York's cybersecurity regulation have specific MFA obligations, subject to defined exceptions. Your business does not need to be headquartered in a state to be affected - serving residents, maintaining records, or operating under a regulated parent company can change the analysis.
Contracts and Cyber Insurance Can Make MFA Mandatory
Many businesses discover their MFA obligation in a document that is not a law.
A client may require it in a vendor security questionnaire or data protection agreement. A prime contractor may require it before granting access to a portal or sharing controlled information. A bank, payroll provider, accounting platform, or legal software provider may make MFA a condition of using its service.
Cyber insurance is another common pressure point. Applications routinely ask whether MFA protects remote access, email, administrator accounts, cloud applications, and systems containing sensitive data. Insurers may require MFA before issuing coverage, impose limitations if it is absent, or challenge a claim if the answers on the application do not match the environment at the time of an incident.
Do not treat those questions as paperwork for an office manager to answer from memory. Review them with the person responsible for IT and security. Keep evidence of where MFA is enabled, which accounts are covered, and any approved exceptions. A policy that says MFA is enabled is not enough if former employees still have active accounts or administrators can bypass the control.
Where MFA Should Be Used First
Even if no regulation or contract applies, MFA should protect the accounts that can cause the most operational and financial damage. Start with business email, identity platforms such as Microsoft 365 or Google Workspace, remote access tools, cloud file storage, financial systems, payroll, customer relationship management platforms, and administrator accounts.
Email deserves special attention. An attacker who controls an executive's mailbox can reset passwords elsewhere, impersonate the executive in payment requests, create hidden forwarding rules, and search for banking details or client information. Password-only email is a high-risk decision for nearly every business.
Not all MFA methods provide equal protection. Text messages are better than a password alone, but they can be vulnerable to SIM swapping and social engineering. Authenticator apps generally offer stronger protection. Security keys and passkeys provide stronger resistance to phishing, making them a strong fit for executives, finance staff, IT administrators, and users with access to regulated data.
MFA prompts can also be abused. Attackers sometimes send repeated approval requests hoping a tired or distracted employee accepts one. This is why number matching, location details, and user training matter. Employees should know that an unexpected MFA request is an incident to report, not an inconvenience to approve.
A Practical MFA Rollout for Small and Mid-Sized Businesses
A rushed rollout can create avoidable support tickets and lockouts. A planned rollout protects the business without disrupting payroll, production, client work, or after-hours support.
Begin by documenting every system with company data or privileged access. Include cloud applications, VPNs, line-of-business software, shared administrator accounts, vendor portals, and remote management tools. It is common to find that MFA is enabled for email but missing from a finance platform or a legacy remote access tool.
Then establish an access standard. Define which MFA methods the company permits, which systems require phishing-resistant methods, and who can approve exceptions. Require individual user accounts wherever possible. Shared logins make accountability difficult and prevent the business from removing access cleanly when someone changes roles or leaves.
A sound rollout typically includes these five actions:
- Enable MFA for administrators and email first, followed by remote access and finance systems.
- Register at least two approved authentication methods for each user, with a documented recovery process.
- Protect emergency or break-glass accounts with strong passwords, restricted use, monitoring, and secure storage procedures.
- Train staff to recognize fraudulent prompts, fake sign-in pages, and helpdesk impersonation attempts.
- Review sign-in logs, failed MFA attempts, new device registrations, and dormant accounts on a regular schedule.
Recovery planning is often overlooked. If an employee loses a phone while traveling, they need a secure, documented way to regain access. If recovery is too easy, a criminal can impersonate the employee and defeat MFA through the helpdesk. Verify identity using more than a simple callback to a number found in an email signature.
MFA Exceptions Need Documentation, Not Assumptions
Some systems cannot support MFA directly. Older manufacturing equipment, specialized medical devices, service accounts, and legacy applications may require a different approach. That does not mean the risk disappears.
When an exception is necessary, document the business reason, system owner, compensating controls, and review date. Possible controls include network segmentation, restricted administrative access, monitoring, jump servers, strong service account management, and removal of unnecessary internet exposure. Exceptions should be narrow and temporary whenever possible.
This is also where a managed IT partner can provide value. Gravity Networks can help businesses identify where MFA is already enforced, locate gaps across cloud and on-premises systems, and build an access policy that supports both day-to-day work and compliance obligations.
Make MFA Part of Ongoing Access Management
MFA is not a one-time switch to turn on and forget. People change roles, phones are replaced, software is added, and vendors receive temporary access. Review user access during onboarding, offboarding, quarterly security reviews, and after any suspected account compromise.
If you are unsure whether MFA is mandatory for your organization, start with your contracts, cyber insurance application, compliance obligations, and highest-risk systems. Then make a clear decision, document it, and put the right controls in place. The cost of adding MFA is usually measured in planning and support time. The cost of explaining why it was missing after a breach is much harder to predict.