Multi factor authentication is the highest value security control available to a small business, and almost everyone has it partially deployed. Partial is the problem, because attackers do not attack the covered accounts.
The methods, worst to best
SMS codes. Better than nothing, and genuinely vulnerable to SIM swapping and interception. Fine for low risk accounts, not for email or anything financial.
Authenticator apps. A six digit code from an app on a phone. A large improvement, widely supported, and the sensible default for most businesses.
Push notifications. Convenient, and vulnerable to fatigue attacks where an attacker sends repeated prompts until somebody taps approve to make it stop. If you use push, turn on number matching so approving requires reading a code rather than tapping a button.
Hardware keys. A physical device. Effectively immune to phishing because the key verifies the site as well as the user. Worth it for administrators, owners and anyone who can move money.
Where the gaps actually are
Administrator accounts. Frequently exempted during setup because it was inconvenient, and then never revisited. This is the worst possible account to leave uncovered.
Service and shared accounts. The reception login, the scanning account, the one three people use. Nobody owns them so nobody secures them.
Legacy protocols. An account can have MFA enabled and still be reachable through an older authentication path that bypasses it entirely. This catches a lot of businesses that believe they are covered.
Remote access. VPNs and remote desktop, which are the routes worth protecting most.
Anything financial. Banking, payroll, payment platforms.
Your domain registrar. Rarely thought about, and control of it means control of your email and your website.
The bit worth doing this week
Make a list of every system that holds client data or moves money. Check each one individually rather than assuming. Most businesses find at least one gap, and the gap is usually somewhere important.
Then write down what happens when someone loses their phone, because that recovery path is often the weakest point in the whole arrangement.