Small Town Sysadmin
Free CJIS checklist

Tech basics

Password managers for a small office: what they are and how to start

Why a password manager beats sticky notes and spreadsheets, what to look for, and a simple way to roll one out to a small team without a big project.

Most offices handle passwords one of three ways: everyone reuses the same one, they’re on sticky notes, or they live in a shared spreadsheet. All three fail the same way. When one password leaks, from a scam email or a breach at some other website, attackers try it everywhere else. That’s why one leaked password can turn into a hacked email account and then a hacked bank login.

A password manager fixes this. It’s a program that makes a long, random password for each account, stores them all in an encrypted vault, and fills them in for you when you sign in. You remember one strong password, and the manager remembers the rest.

What the official guidance says

CISA, the US government’s cybersecurity agency, recommends passwords that are unique for every account and at least 16 characters long, and it points people to a password manager as the easy way to manage that. It also notes that some password managers are free (including ones built into web browsers) and others cost money.

NIST, the federal standards body, goes further in its current password guidance (SP 800-63B, revision 4). Systems that check passwords are told to allow password managers and pasting into the password box. They are told not to force odd character mixes or regular password changes. A password that’s the only protection on an account should be at least 15 characters long. So if a website won’t let you paste, that’s the website’s problem, not yours.

What to look for

You don’t need the fanciest product. For a small office, check that it:

  • Has a business or team plan, so you can share logins without sharing the password in an email or chat.
  • Lets you remove someone’s access when they leave, which a spreadsheet can’t do.
  • Works on phones and in the browser, or people won’t use it.
  • Supports two-step sign-in on the vault itself. Turn that on first. See Turn on two-step sign-in.
  • Has a recovery plan. Ask what happens if the person who set it up is gone. If nobody can get in, you’ve built a new way to lock yourselves out.

Be careful with free personal accounts used for business logins. When the employee leaves, the passwords go with them. Check the vendor’s current terms and pricing yourself before you buy; both change.

How to roll it out

  1. Pick one person to own it, and a backup person who can also get in.
  2. Make the master password a passphrase. CISA suggests several unrelated words strung together, which is long but memorable. Don’t reuse it anywhere else.
  3. Turn on two-step sign-in for the vault.
  4. Start with the accounts that matter most: email, bank, payroll, domain and website hosting, and your Microsoft 365 or Google admin account. Don’t try to move everything at once.
  5. Let the manager generate new passwords for those accounts as you go, and change old ones while you’re signed in.
  6. Write down where recovery details live. Record where the recovery details live using the free important accounts master list, and keep it locked up. Don’t write the passwords on it.
  7. Add shared logins (the alarm company portal, the shared phone system admin page) into a shared folder, not by emailing them.

What a password manager doesn’t do

It won’t stop you from typing a password into a fake sign-in page if you ignore the warning signs. If you land on what looks like your bank’s page from an email link, stop and check the address. How to tell if an email is a scam covers the signs.

It also isn’t a substitute for two-step sign-in on the accounts themselves. Use both.

When to ask for help

If your office has an IT company, ask them which password manager they already support and whether it fits your contract. If you have none, the steps above are doable by one careful person in an afternoon. Stop and get help if you’re unsure how to hand over the admin accounts safely.

Sources

All articles