Multi-factor authentication MFA
Requiring two or more proofs of identity to log in — typically something you know (a password) plus something you have (a phone or key).
For small firms
The single most effective, lowest-cost control available to a small firm. Turn it on everywhere, starting with email and financial systems.