Roll out a password manager in stages: admins first, shared accounts second, everyone else third. Set a minimum of 16 random characters per CISA guidance, turn on MFA for the vault itself, and retire spreadsheets and chat messages as places to keep credentials. Plan for two weeks, not a single announcement.
What CISA recommends
CISA's guidance for small and medium businesses says passwords should be at least 16 characters, random or a passphrase of five to seven unrelated words, and never reused. It recommends a company wide password manager so staff remember only one master password, and says to change default credentials before systems go live. It also recommends phishing resistant MFA on top, and suggests single sign on as the business grows.
Week one: pick and pilot
Choose a manager that supports team vaults, shared folders, an admin console, and MFA on the vault. Pilot with the two or three people who manage the most accounts: cloud, source control, domain registrar, email admin.
Ask them to move the high value accounts first. These are the ones where a stolen password does the most harm.
Week two: shared accounts
Every small team has shared logins: the social account, the analytics tool, the vendor portal. Put them in a shared vault with named access, not in a chat thread. Where the service supports individual seats, move to those and delete the shared login instead. Shared accounts hide who did what.
Weeks three and four: everyone else
Run a 30 minute session. Show how to generate a password, how to autofill, and how to recover access if a phone is lost. Then set a date after which old storage places are cleaned up.
Do not force a password change on every account at once. Change passwords as people touch each account, and prioritise anything found in an old spreadsheet.
Common mistakes
- Using the manager but keeping a weak master password. The master password should be long and unique.
- No MFA on the vault.
- No recovery plan if the vault admin leaves. Have two admins.
- Letting people store the manager recovery kit in the same place as the vault.
- Skipping offboarding. When someone leaves, remove vault access and rotate shared credentials they could see.
How to know it worked
Ask the admin console, if it provides one, for adoption, weak and reused password reports. A rising adoption number is a better signal than a policy document.
Common pitfalls.
A note on adoption. People adopt tools that save them time, so measure friction. Check that browser autofill and the mobile app work on the devices your team actually uses, and that sharing an entry takes seconds. If the tool is slower than a chat message, people will go back to chat. Ask for feedback after two weeks, fix the top complaint, and have leaders use the manager visibly. Adoption by example does more than a policy document.
Quick check
Is a browser built in password saver enough?
It beats reuse, but a team needs shared vaults, admin control and offboarding. A company manager gives you those.
Does a manager replace MFA?
No. CISA recommends using both. MFA protects the account if the password is stolen.
Sources
Last reviewed: 19 October 2026.
