Many offices still make everyone change their password every 90 days. It feels responsible. In practice it produces Summer2026! followed by Fall2026!, which is exactly what attackers guess first.
Current guidance, including the US government's NIST recommendations, has moved on. Here is what a modern policy looks like for a small business.
1. Make passwords long, not weird
Length beats complexity. A passphrase of four or more unrelated words, such as elephant-moonlight-coffee-whisper, is far harder to crack than a short password with a swapped-in "@" and "3". Aim for at least 14 characters for staff, and longer for administrators.
2. Do not force routine changes
Change a password when there is a reason: a suspected breach, a lost device, or someone leaving the company. Forced expiry trains people to make small, predictable edits. It also adds help-desk calls and sticky notes.
3. Use a password manager
Nobody can remember dozens of unique passwords, so they reuse them. A business password manager lets each person use a unique password everywhere, and gives you a way to share logins without pasting them into email or chat. It also means the passwords for your firewall, your domain and your web hosting are written down somewhere safe rather than in one person's head.
4. Block known-bad passwords
Microsoft 365 and Active Directory can reject passwords that appear in breach lists or contain your company name. Turn that on. It stops the most common choices before they are ever created.
5. Set sensible lockouts
A few wrong attempts should pause the account for a while, which makes guessing impractical without locking out an honest user for long.
6. Require multi-factor authentication
This is the part that matters most. A password alone, however good, can be phished. Add a second step on email, remote access and every administrator account, and prefer hardware keys or passkeys for the most sensitive logins.
7. Treat administrator accounts differently
- Separate admin accounts that are never used for daily email or browsing.
- Very long, random passwords stored in the manager.
- One carefully protected emergency account, excluded from normal sign-in rules, with an alert that fires if anyone ever uses it.
- A quarterly review of who still needs access.
Putting it on one page
A good policy fits on a single page that every employee can understand. If yours is ten pages of rules nobody reads, it is not protecting you. We help local businesses write and enforce a practical policy, and set up the tools to make it easy to follow.