You Turned On MFA. Good. Here's the Rest of the Picture.

A plain-English guide with eight quick checks and a short list you can start this week. Every point links to the CISA, FTC, NIST, or New York State source behind it.

• Where MFA matters most: email, admin accounts, payroll, your website host, and the places that are easy to miss.
• The stronger kind: how text codes compare with authenticator apps, passkeys, and security keys, in CISA's own ranking.
• The rest of the picture: access, updates, backups, payment requests, and what New York's SHIELD Act asks of businesses that hold customer information.