A Sensible Password Policy for Small Businesses

What makes a password policy actually work?

Most small-business policies fail because they are written as a rulebook nobody reads. A policy that works is short enough to fit on one page, uses plain language and tells people what to do rather than listing what is forbidden. It should also match how your team really works, including phones, shared devices and cloud tools.

Think of the policy as three layers: how passwords are created, how they are stored and protected, and what happens when something goes wrong. If each layer has one or two clear rules, staff can remember them. Everything else, such as detailed technical settings, belongs in a separate checklist for whoever manages your IT.

How long and complex should passwords be?

Current good practice favours length over complexity. A passphrase made of several unrelated words is easier to remember and harder to guess than a short string full of symbols that people predictably tweak, such as swapping letters for numbers. Set a sensible minimum length and encourage passphrases for the few passwords people must memorise.

Equally important, every account needs its own password. When one website leaks its database, attackers try the same email and password elsewhere. If your staff reuse passwords, a breach at an unrelated service can open your email or accounting software. Uniqueness is why a password manager is so valuable: nobody can remember dozens of unique passwords.

• Use long passphrases rather than short, symbol-heavy strings.
• Never reuse a password across work and personal accounts.
• Avoid names, birthdays, phone numbers and company names.
• Let the password manager generate random passwords for everything else.
• Block commonly used passwords where the system allows it.

Should you force password changes every few months?

Many older policies demand a change every thirty or ninety days. In practice this encourages small predictable edits, like adding a number at the end, and more reset requests to your helpdesk. Many security bodies now advise changing passwords when there is a reason, such as a suspected leak, rather than on a fixed calendar. Check the current guidance for your sector before deciding.

Do enforce changes in specific moments: when an employee leaves, when a device is lost, when a vendor tells you of a breach, or when a password was shared in a chat. Combine this with monitoring for exposed credentials if you can, and you get better protection with less irritation.

Why do multi-factor authentication and a password manager matter most?

Multi-factor authentication adds a second proof, usually an authenticator app or a security key, so a stolen password alone does not open the account. Prioritise email, banking and payment portals, cloud storage, accounting and admin panels of your website. Prefer authenticator apps over SMS codes where possible, and never read out a one-time code to a caller.

A business password manager gives each person unique passwords, lets you share access to a tool without sharing the actual password, and makes offboarding easier because you can revoke access in one place. Choose a reputable product, protect the master password with multi-factor authentication and agree who administers it.

How should shared accounts and ex-employees be handled?

Shared logins are convenient and risky, because nobody knows who did what and nobody feels responsible. Where a tool supports it, give each person their own account with the right permissions. Where it does not, store the shared credential in the password manager, limit who can see it and rotate it whenever someone leaves.

Keep an up-to-date list of every business account, who owns it and who can access it. When someone resigns, close or transfer their access on the last day, including email forwarding, social media pages, domain registrar, hosting and payment dashboards. Forgotten accounts of former staff are a frequent, quiet entry point.

• Maintain an account inventory with an owner for each tool.
• Remove leavers from every system on their final day.
• Rotate shared credentials after any change in who knows them.
• Use separate admin accounts for administrative tasks.

How do you introduce the policy without resistance?

Start with the why. Explain in one short session how password reuse and phishing lead to real losses, then show people how the password manager saves them effort. A policy that makes daily work easier is adopted; one that adds friction is bypassed.

Roll it out in stages: leadership and finance first, then everyone else. Give a deadline, offer help setting up, and review adoption after a month. If your business handles customer data or works with larger clients who audit suppliers, ask a security professional to align the policy with those expectations and with current Indian data-protection requirements.

Step by step

1. List your critical accounts. Note email, banking, accounting, website admin, domain and cloud accounts and who owns each.
2. Choose a password manager. Pick a reputable business tool, secure its master login and set it up for each employee.
3. Turn on multi-factor authentication. Enable it first on email and finance accounts, then on everything that supports it.
4. Write the one-page policy. State passphrase length, uniqueness, no sharing, and what to do if a password is exposed.
5. Train and set a date. Run a short session, help people migrate and set a deadline for completion.
6. Review leavers and exposures. Check offboarding and exposed-credential alerts regularly, and update the policy when needed.

Frequently asked questions

Is it safe to write passwords in a notebook?

A locked, private notebook is better than reusing one weak password everywhere, but it is not suitable for a team. A password manager is safer and easier to share and revoke.

Are SMS one-time codes good enough?

They are much better than no second factor, but authenticator apps or security keys are stronger because SMS can be intercepted or redirected. Use the strongest option each service offers.

What should we do if an employee shares a password by mistake?

Change that password immediately, check recent activity on the account and note the incident. Treat it as a learning point, not a punishment, so people report such slips quickly.

Do we need a password policy if we have only five employees?

Yes, because small businesses are often targeted precisely for weaker habits. A one-page policy is quick to write and easy to follow with a handful of people.