Why Your Small Business Needs a Written Password Policy

Small businesses are the primary target for credential-based attacks. The NCSC's 2025 Cyber Security Breaches Survey found that 59% of UK small businesses experienced a breach or cyber attack in the previous 12 months — and compromised passwords were the most common cause. For US businesses, the numbers are similar: the Verizon 2026 DBIR reports that credential theft and misuse account for nearly half of all breaches in organisations with fewer than 100 employees. Size does not protect you; in many ways, it makes you a more attractive target because small businesses typically have weaker security controls than large enterprises.

Without a written password policy, you rely on each employee's individual judgment about what constitutes a secure password. Some use their dog's name. Others reuse their personal Gmail password. A few share credentials via Slack or WhatsApp "just to get the job done faster." Each of these decisions is a security gap in your business. I have spoken with small business owners who assumed their team "knew better" — only to discover that half their staff were using the same password across their business email, project management tool, and personal Netflix account.

A written password policy does three things that ad-hoc security cannot: it sets a consistent security baseline across your entire team, it gives employees clear rules rather than vague expectations, and it establishes accountability — everyone knows what is expected and what is prohibited. When a policy is written down, it is objective. There is no ambiguity about whether a 10-character password meets the requirement or whether sharing a login via a messaging app is allowed.

For UK businesses pursuing Cyber Essentials certification, a documented password policy is a requirement, not optional. Even without certification, the same standards apply: your policy should protect your business, your customers' data, and your team's accounts. The cost of writing a policy is zero. The cost of not having one — a data breach, regulatory fines, reputational damage — can run into tens of thousands of pounds.

Bottom line: A password policy is not bureaucracy — it is the single most cost-effective security control you can implement. It costs nothing to write and can prevent the credential theft that leads to the average £5,600 recovery cost for a small business breach. In the US, the average cost for a small business breach exceeds $200,000 according to IBM's 2026 Cost of a Data Breach report.

The Five Essentials of a Small Business Password Policy

An effective password policy for a small business covers five areas. These are the minimum requirements for any organisation with more than one employee. If you are starting from scratch, implement these five essentials in order of priority — do not wait until you have a perfect policy before rolling anything out.

1. Minimum Length and Strength Requirements

Set a minimum password length of 12 characters for all business accounts. Avoid arbitrary complexity rules (must contain one uppercase, one number, one symbol) — research consistently shows that length is more important than character variety. A 16-character lowercase passphrase like "correct-horse-battery-staple" is stronger than an 8-character mixed-case password like "P@ssw0rd" and significantly easier for employees to remember. The NordPass password generator can create these strong passphrases automatically, eliminating the need for employees to invent their own.

2. Prohibit Password Reuse

Every business account must have a unique password. Reusing a password across business and personal accounts means a breach of an employee's personal account on a low-security forum can lead directly to a compromise of your business systems. Attackers know this — credential stuffing attacks automatically try leaked username and password combinations across hundreds of services. Enforce uniqueness through a password manager that generates and stores strong, random passwords for each account. With a tool like NordPass, employees never need to remember individual passwords; they just need their master password and the vault does the rest.

3. Multi-Factor Authentication Requirement

MFA must be required on all accounts that support it — including email, payroll, accounting software, CRM, cloud storage, and business banking. The most important account to protect with MFA is your business email, because email is the recovery mechanism for virtually every other account. Prioritise phishing-resistant MFA (FIDO2 security keys or passkeys) for your most critical systems, such as financial platforms and domain registrars. For everyday accounts, TOTP-based authenticator apps are far more secure than SMS-based codes, which are vulnerable to SIM-swapping attacks.

4. Prohibit Credential Sharing

Employees must not share passwords via email, messaging apps, sticky notes, or verbal handover. Instead, use the shared vault feature in your password manager, which allows authorised team members to access shared credentials without ever seeing the underlying password. NordPass Business provides shared vaults with granular permission controls — you can grant view-only access, editing rights, or temporary access that expires automatically. This eliminates the security risk of credential sharing while maintaining the workflow flexibility that small teams need.

5. Session and Device Security

Require automatic screen locking after 5 minutes of inactivity. Prohibit saving passwords in browsers without the master password protection of a password manager. Require employees to report lost or stolen devices within 1 hour — and have a process in place to remotely wipe those devices. If your team works remotely, require a VPN when accessing business systems from untrusted networks such as public Wi-Fi in coffee shops, hotels, or co-working spaces.

NIST and NCSC-Aligned Password Rules

Your password policy should align with current authoritative standards. The 2025 update to NIST SP 800-63B and the NCSC Cyber Aware guidance have shifted away from traditional complexity-and-expiry approaches that research has shown to be counterproductive.

NIST SP 800-63B 2025: - Minimum 8 characters for user-chosen passwords - Minimum 6 characters for randomly-generated passwords - SHALL NOT require periodic password changes (only on compromise) - SHALL compare passwords against commonly-used or compromised password lists - SHALL allow all printable ASCII characters and Unicode

NCSC Cyber Aware (2025–2026): - Use a password manager to generate and store passwords - Create passwords with at least 12 characters - Use 2-Step Verification (MFA) wherever possible - Do not change passwords unless you have reason to believe they are compromised - Use three random words for memorable passphrases

The key change in both frameworks is the removal of mandatory periodic password changes. Forcing employees to change passwords every 90 days leads to predictable patterns — Password1!, Password2!, Password3! — that are actually less secure than a stable, strong password. Only require a password change when there is evidence of compromise.

Account Lifecycle Management

Onboarding: When a new employee joins, generate their initial credentials using a CSPRNG password generator. Deliver the password through your password manager's secure sharing feature rather than email. Walk through MFA setup on day one — before they access any business systems. This sets the security tone from the start and prevents the common problem of new employees creating their own weak passwords.

Role changes: When an employee changes role, review their access. Remove credentials for systems they no longer need. Update shared vault permissions in your password manager. This is often overlooked — I have seen cases where employees retained access to systems for years after changing roles, creating an unnecessary security risk.

Offboarding: When an employee departs, immediately rotate all credentials they had access to — not just their own login, but every shared credential they could see in the password manager. Revoke all active sessions across every platform. A password manager like NordPass makes offboarding straightforward: you can transfer vault ownership, revoke access to shared folders, and ensure departing employees take no credentials with them.

Employee Training and Social Engineering Defence

A password policy is only effective if employees understand and follow it. Training is not a one-time event — it is an ongoing process that needs reinforcement, especially as new phishing techniques emerge.

Phishing awareness: Credential theft almost always starts with a phishing email. Your policy should require employees to report suspicious messages rather than clicking links. Train employees to recognise the red flags covered in our guide on how to spot a phishing email. Run simulated phishing campaigns quarterly to test and reinforce learning — tools like GoPhish are free and easy to set up for small teams.

Social engineering awareness: Train employees that no legitimate IT team, vendor, or manager will ever ask them to share a password or MFA code. If someone calls claiming to be from IT support and asks for credentials, the correct response is to hang up and call the IT team back on a known number. MFA fatigue attacks — where attackers bombard a user with push notifications until they approve one — are becoming common in 2026, so employees should know to never approve an MFA request they did not initiate.

Incident reporting: Create a no-blame culture for reporting credential compromise. A delayed report costs far more than a prompt one. If an employee fears being punished for falling for a phishing email, they will hide the incident, and the attacker will have more time to move laterally through your systems. Make it clear that quick reporting is rewarded and hesitation is the real problem.

Enforcing Your Policy with Free and Low-Cost Tools

You do not need an enterprise IT budget to enforce a strong password policy. Here are the tools and built-in controls available at little to no cost: - Microsoft 365 Business: Built-in password policy controls, Azure AD Password Protection (free), Conditional Access MFA policies - Google Workspace: Password length enforcement, mandatory MFA policies in Admin Console - Password managers: NordPass Business enforces security policies, provides shared vaults, and includes a security audit dashboard that shows weak, reused, or compromised passwords across your team - Have I Been Pwned: Free API to check whether a password appears in known data breaches - VPN for remote workers: Require a VPN on untrusted networks — many providers offer business plans starting at under £10 per user per month

What to Do When a Credential Is Compromised

Despite your best efforts, credential compromises will happen. Having a written incident response procedure in your password policy ensures your team acts quickly and consistently when it does. Follow these steps:

1. Immediately rotate the affected credential
2. Revoke all active sessions on the compromised account
3. Check account recovery settings — attackers often add their own recovery email or phone number
4. Review access logs for suspicious activity in the hours before and after the compromise
5. Report to the NCSC at report@phishing.gov.uk (UK) or CISA (US)
6. Notify any customers whose data may have been exposed — transparency builds trust

Key Takeaways

The five essentials — minimum 12-character unique passwords, MFA on all accounts, no credential sharing, account lifecycle management, and ongoing security training — cover the vast majority of credential-related risks that small businesses face. Implementing these does not require a large budget or a dedicated IT team. A business-grade password manager like NordPass helps enforce these policies with shared vaults, security audits, and seamless employee onboarding — all for a fraction of the cost of a single data breach. Write your policy this week, share it with your team, and start closing the security gaps that attackers rely on.