Password Security for Small Businesses

Small businesses are frequent targets because they hold valuable data, such as customer details and payment systems, but often lack a security team. A sensible password policy closes many of the most common gaps.

The essentials

1. A business password manager with shared vaults, so staff never pass passwords around in chat or spreadsheets.
2. Unique, generated passwords for every system, created with a secure password generator or the manager.
3. Two-factor authentication on email, banking, accounting, domain registrar and website admin accounts.
4. Individual logins wherever possible, so actions can be traced and access removed per person.

Shared accounts

Some services only allow one login per business. Store these in a shared vault, limit access to the people who need them, and turn on 2FA with a method more than one administrator can use.

Onboarding

• Create the new employee's accounts with temporary passwords they must change at first login.
• Add them to the right password-manager vaults.
• Require 2FA setup on day one.

Offboarding

• Disable the person's accounts the day they leave.
• Remove them from shared vaults.
• Change every shared password they had access to.
• Transfer ownership of documents, domains and social media accounts.

A simple written policy

Keep it short enough that people read it:

• Minimum 16 characters, generated, never reused.
• No passwords in email, chat, notes or spreadsheets.
• Report suspected phishing immediately, with no blame.
• 2FA required on all business systems that support it.

Train for phishing

Strong passwords do not help if staff type them into a fake login page. Short, regular reminders about checking links and sender addresses are one of the best investments a small business can make.

Frequently asked questions

How should we handle employee offboarding?

Employee offboarding should disable the person's accounts on their last day, remove them from shared vaults and change every shared account password they could access.

Is there a password policy template for small businesses?

A simple password policy template: 16+ characters, generated, unique; no passwords in email or chat; 2FA on all business systems; a business password manager for shared account passwords; and immediate reporting of phishing. Turn it into a one-page password checklist for staff.

How to share passwords safely at work?

To share passwords safely, use the sharing feature of a password manager instead of chat or email. Access can then be revoked later, which is the safest way to handle shared account passwords and password for work accounts.

How to spot phishing emails?

To spot phishing, check the sender's real address, hover over links before clicking, be suspicious of urgency, and never enter a password from an email link. Phishing protection improves greatly when staff use a password manager that only autofills on the real site.