James Whitfield
Why a password policy is still worth the effort
Most security incidents at small firms don't begin with a hooded figure and a wall of green text. They begin with a login. A password reused from a personal account, a shared admin credential, a supplier portal still using the company name and a year. Criminals buy lists of leaked email and password pairs, then try them across every service they can find — automated, relentless and cheap. If your team's credentials work on one of those lists, the odds of someone trying them against your accounting software or email are high.
A password policy isn't bureaucracy for its own sake. It's the smallest, cheapest control you can put in place, and the one your team will interact with every single day. Get it wrong and you'll get sticky notes under keyboards and a shared spreadsheet called "logins final v3". Get it right and nobody really notices it exists.
Ask for length, not cleverness
The old advice — capital letters, numbers, symbols, changed every 90 days — produced passwords like P@ssw0rd1 and then P@ssw0rd2. Crackers know those patterns by heart, and forced expiry just encourages people to make tiny, predictable changes. The National Cyber Security Centre's guidance has moved in the opposite direction: prioritise length, and don't force regular changes unless there's evidence of a breach.
A passphrase of four or five unrelated words is easier to remember and far harder to guess than eight characters of punctuation soup. For your policy, that means:
- A minimum of 16 characters for anything work-related.
- Words joined together rather than single dictionary words — think copperbiscuitlanternriver, not password1.
- No reuse across work and personal accounts, ever.
- No sharing, no writing them down where a client or courier can see them.
- Multi-factor authentication switched on wherever the service offers it, especially email, banking and anything that holds customer data.
That last point deserves emphasis. A strong password stops most automated attacks; multi-factor authentication stops almost all of them. If you only do one thing after reading this, do that one.
Ban reuse openly, and check that it's actually happening
Reuse is the quiet killer. Someone uses their work email address and the same password they've used for a decade on a hobby forum. The forum gets breached, the credentials are dumped, and suddenly your Microsoft 365 tenant is on a list somewhere in eastern Europe.
Say this plainly in your policy: work credentials must be unique to work. Then make it possible. You cannot ask people to memorise thirty distinct passphrases, so the next section matters more than any rule you write.
Provide a password manager — and pay for it
This is the part where a lot of small businesses try to save money and end up worse off. A free browser-based setup works reasonably well for one freelancer. For a team of five or more, buy proper business seats in a reputable password manager. Expect to pay somewhere between £3 and £8 per user per month, which for a ten-person firm is roughly the cost of one round of coffees.
What you get for that money matters:
- A shared vault so two people can access a client's portal without texting each other the password.
- Generated, unique passwords nobody has to invent or remember.
- Access controls that let you remove someone's vault access the moment they leave.
- An audit trail showing who has seen which credential, which is genuinely useful when a client asks.
Roll it out as a company-paid tool, set it up together in a 30-minute session, and help people import their existing logins. Do it with them rather than sending a policy document and hoping.
Roll it out without a rebellion
People resist rules that make their day harder. So frame the change around effort saved rather than risk avoided — the manager means no more resetting the same forgotten password, and no more hunting through old emails for a supplier login.
Practically, this means:
- Lead from the top. If the directors aren't using the password manager, nobody else will.
- Put the policy in your onboarding pack and your staff handbook, in one page of plain English.
- Require strong unique credentials for admin accounts, finance systems and anything holding customer data first. Expand from there.
- Kill shared logins where you can, and where you genuinely can't, keep them in the shared vault so they're at least rotated and traceable.
- Add a line to your offboarding checklist: revoke vault access, disable accounts, rotate any shared credentials they knew.
Review it once a year, not once a quarter
A password policy that gets rewritten constantly becomes noise. Aim to review it annually, or whenever something significant changes — a new starter, a breach at a supplier, a move to a new email platform. Check that multi-factor authentication is switched on for every critical service, that nobody has quietly gone back to an old habit, and that your leavers list matches your active user list. That last check catches more problems than any password length rule ever will.
Keep it short, keep it human, and give your team the tools to follow it without friction. Security that inconveniences people gets worked around. Security that saves them a job gets adopted.
