Security advice pushed small businesses towards putting a second step on every important account, and that advice was right. What it did not say clearly is that the second step usually ends up on a single object that lives in a pocket, gets dropped, gets stolen and occasionally goes into a river. For a lot of small businesses, that phone is now the single point on which email, banking, the domain, the accounting system and the social accounts all depend.
The failure is specific and worth picturing properly. The phone is gone. To get into the email you need a code, which is sent to the phone. To get a replacement number from the network you need to prove who you are, which often involves the email. To get into the bank you need the app that was on the phone. Each door is guarded by a key kept behind one of the other doors, and the loop closes. People in this position routinely lose access for days, and businesses that trade on email lose that time completely.
The preparation takes an hour and is almost entirely paperwork. When an account offers backup codes - a short list of one-time strings to use when the usual method is unavailable - generate them and put them somewhere physical, not in the email account they unlock. Where a second method can be added, add one that does not live on the same device. Write down which accounts are protected by what, because during an incident nobody can remember, and the list is the difference between a methodical recovery and guessing.
The recovery details matter as much as the codes. Most services have an account-recovery path that depends on information you set up in advance: an alternate address, a phone number, a set of questions. Those are worth checking once a year, because the alternate address is frequently one that was abandoned, and a recovery route pointing at a dead mailbox is worse than none - it looks like a safety net right up to the moment you fall through it.
Finally, decide now who else can get in. A business where exactly one person can reach the bank, the domain registration and the main mailbox is exposed to far more than a lost phone; illness and holidays produce the same outage. The answer is not sharing a password. It is giving a second trusted person their own access, with their own credentials, at whatever level is appropriate - so that the business has two hands, and losing one is an inconvenience rather than a stoppage.