CANADA NEXTECH / 75-SECOND EXPLAINER
MFA: protect the login and the recovery
A short visual guide to stronger sign-ins, unexpected prompts and practical recovery planning for business accounts.
Jump to a step
NOW PUT IT TO WORK
MFA and Account Recovery Checklist
Work through 12 checks and record evidence, owners and next steps.
Full transcript
The video uses on-screen text throughout. The complete explanations are also available here.
Protect the login.
Multi-factor authentication adds another way to verify identity. A recovery plan helps keep legitimate users from being locked out.
Start with important accounts.
Review business email, administration and other critical services. Record an owner for each account and its recovery process.
Choose the supported method.
Consider phishing-resistant passkeys or security keys where supported. Check compatibility and user-verification requirements before rolling them out.
Confirm actual coverage.
Check the service settings for users and administrators. Track exceptions and give someone responsibility for resolving them.
Pause at unexpected prompts.
Reject a sign-in request you did not initiate. Use a trusted contact method to report it, and keep sign-in codes private.
Plan for a lost device.
Arrange an approved backup method. Protect recovery information and confirm who can help if the usual authenticator is unavailable.
Practise before an emergency.
Walk through recovery with your administrator. Follow the provider's supported process and avoid a test that could lock out the business.
Make the next move.
Use the Canada NexTech account checklist to review coverage, recovery and exceptions. MFA reduces risk; it does not remove every threat.
Sources behind the guidance
Prepared by Canada NexTech. Source guidance checked October 28, 2026.
- Cyber Centre: Foundational security actions (ITSAP.10.300) ↗
- Cyber Centre: Multi-factor authentication (ITSAP.30.030) ↗
- Cyber Centre: Passkey considerations (ITSAP.30.033) ↗
This is independent educational material, not an endorsement by the source organizations. Apply the guidance to your own systems with the person responsible for your IT. A completed checklist is not a certification or a complete security assessment.