How to Create a Strong Password Policy for Your Team (Without Driving Them Crazy)

Somewhere in your company right now, a login and password sit in a shared spreadsheet called something like Accounts_final_v2. It isn't carelessness. It's the predictable result of rules nobody can follow: eight characters, one capital, one number, change it every 60 days, don't write it down. Faced with that, sensible people reuse the same password everywhere and bump a digit at the end.

A password policy that works doesn't fight human nature. It removes the reasons people cut corners in the first place. Here's how to build one your team can live with.

Start With What Actually Gets Accounts Stolen

Most account takeovers don't come from someone guessing a clever password. They come from credentials that leaked at some other company and were tried again against yours, or from a login page that looked convincing enough to collect them directly. That shifts the goal. You're not trying to make one password unguessable; you're trying to make a single leaked password worthless.

Two controls carry most of the weight: unique passwords on every account, so a breach at one vendor doesn't cascade into yours, and a second factor, so a stolen password alone isn't enough to get in. Length rules, symbol requirements and rotation schedules are secondary. Build the policy on those two pillars and everything else becomes easier to justify.

Ask for Two Passwords, Not Twenty

Nobody memorises thirty strong unique passwords. Stop making that the standard. Ask for two secrets per person instead:

1. A master passphrase for their password manager.
2. A device or account password — laptop login, work email — they can recall without opening the vault.

Everything else lives in the manager, generated and filled automatically. For the master passphrase, length beats cleverness. Four or five unrelated words strung together is both stronger and easier to remember than a short string of substitutions. Set a floor of at least 12 to 16 characters for anything a human chooses, and let the tool generate 20-plus random characters for the rest.

Then drop calendar-based rotation. Modern guidance from standards bodies such as NIST advises against forcing password changes on a fixed schedule, precisely because it pushes people toward predictable patterns — Spring2025 becomes Summer2025. Rotate on evidence of compromise, or when someone with access leaves, not because a quarter ended.

Make the Password Manager Non-Negotiable

If the manager is optional, half the team uses it, half doesn't, and you have no visibility into either group. Treat it as company-provided infrastructure, the same way you'd treat email.

• Pick a tool with a business tier — an admin console, shared collections, and single sign-on support. Consumer plans won't give you offboarding controls.
• Provision accounts from a central staff list, not via an invite link dropped in a chat channel. The link always gets forwarded.
• Solve recovery before you launch. Set an emergency access contact, store a printed recovery kit somewhere physically secure, or define a break-glass process. Lost vault access is the single most common reason rollouts stall.
• Move shared logins into shared vaults with access logging. One account used by six people can never be rotated cleanly and never be traced.
• Demo autofill once, for five minutes. Adoption depends far more on seeing the browser extension fill a login than on reading the policy document.

Layer On MFA Without Creating a Support Queue

Multi-factor authentication is where policy meets daily irritation, so pick methods with friction in mind:

• Passkeys or hardware security keys — strongest, and once enrolled, the fastest to use. Worth it for admins and finance.
• Authenticator apps with number matching — a solid default for most teams.
• Push approvals — convenient, but always switch on number matching so a tired tap can't approve an attacker's login.
• SMS codes — better than nothing, weakest of the set, and vulnerable to SIM swapping. Use only where nothing else fits.

Where your tools allow it, require two enrolled factors per person and issue backup codes that people store inside the vault rather than in a drawer. Expect a spike in helpdesk tickets during the first week. Get ahead of it with a one-page guide and one named person who can verify identity and reset a factor.

Write the Policy in Plain Language

A policy nobody reads protects nobody. Keep it to a page or two and state plainly what's required, what's provided, and what happens when something goes wrong. A workable skeleton:

• Scope: all employees, contractors, and service accounts.
• Required: a unique password per account, stored in the company vault; MFA on email, VPN, cloud admin and finance systems.
• Prohibited: sharing individual credentials, saving work passwords in personal browsers, reusing a work password on any outside site.
• Exceptions: documented, time-limited, approved by a named role — not granted verbally in a hallway.
• Reporting: tell IT within an hour of a suspected compromise. Say explicitly that honest reporting carries no disciplinary consequence. If people fear punishment, they go quiet, and quiet is expensive.
• Review: revisit annually and after any significant incident.

When Something Leaks, Have a Ten-Minute Checklist

Most credential incidents are survivable if the first hour goes well. Agree on the sequence in advance so nobody improvises at 11pm.

1. Reset the password on the affected account.
2. Revoke active sessions and refresh tokens. Changing a password often leaves an attacker's existing session alive.
3. Check sign-in logs and mail-forwarding rules for anything you didn't create.
4. If that password was reused anywhere else, change it there too.
5. If it was a shared credential, rotate it in the vault and review who had access.

Make the Secure Path the Easy One

Roll this out in stages rather than all at once. Week one, deploy the password manager to a small pilot group and fix whatever confuses them. Week two, turn on MFA for email and your remote access tools with hands-on help. Week three, extend it to everyone else and retire the old shared spreadsheet.

Then measure the right things: how many accounts still lack a second factor, how many vaults are unused, how quickly people report problems. Skip the leaderboards and the shaming. The goal isn't a perfect document sitting in a compliance folder — it's a team that has one strong passphrase, a manager doing the remembering, and a second factor standing between a leaked password and your data.

Photo: Pixabay / Pexels