Multi-factor authentication (MFA)
Requiring a second proof of identity beyond a password, usually a code or a prompt on a phone.
MFA is the single highest-value security control available to a small office and it is usually free with the licences you already own. Enabling it across a Microsoft 365 or Google Workspace tenant stops the overwhelming majority of account compromises, which are the most common way small companies actually get breached.
The reason it does not get enabled is not cost. It is that switching it on breaks something for somebody on day one, usually an old mail client or a shared account nobody wants to touch, and there is no one whose job it is to work through that.
Enforcement is the part that matters. MFA available but optional is close to MFA off, because the accounts most worth attacking belong to the people most likely to skip it.
What it costs
Free in Microsoft 365 and Google Workspace. What costs money is somebody enforcing it and handling the lockouts, which is inside a per-seat plan.
Related questions
Does MFA cost extra in Microsoft 365?
No, basic MFA is included in every business plan. Conditional access policies need a higher tier, but plain enforced MFA does not.
What happens when somebody loses their phone?
An administrator resets their MFA registration. It is a routine support ticket, and it is the main reason enforced MFA needs somebody available to unlock people.