Strong Password Policies: The Foundation of Small-Business Cybersecurity

What modern password policy looks like

• Length over complexity

  14+ characters; no required mix of symbols. A long passphrase beats “P@55w0rd!” every time, and people can remember it.

• Unique per site

  Reused passwords are still the #1 root cause of small-business account takeover. A password manager makes uniqueness trivial.

• Block common & breached

  Block known-bad and previously-breached passwords at sign-in (Microsoft Entra ID and Google Workspace can do this natively).

• No forced rotation without cause

  NIST and Microsoft both deprecated routine forced rotation. Rotate when something is compromised, not on a calendar.

• MFA everywhere

  Phone-based SMS is OK; an authenticator app is better; passkeys / hardware keys are best.

• Plan for shared access

  Shared mailboxes, social media, vendor portals. Use the password manager’s shared-vault feature, not a Google Doc.

• 14+Character minimum
• 100%MFA coverage on critical accounts
• 0Reused passwords across services
• 0Forced rotations without compromise evidence

Rolling out a password manager in a small Vancouver business

1. Pick the tool. 1Password Business or Bitwarden Teams. Both are CAD-friendly.
2. Set up the team. Vaults per role; shared vaults for groups (marketing, ops).
3. Migrate. Import from browsers + the spreadsheet. Generate fresh passwords for the high-value accounts during migration.
4. Train. 30-minute team session. Show how to use the browser extension and the mobile app.
5. Audit. Use the watchtower / reports to retire weak and reused passwords inside 30 days.

Where passkeys fit

Passkeys (WebAuthn / FIDO2) are quietly replacing passwords on the most-attacked services — Microsoft, Google, GitHub, 1Password itself. Where supported, enabling passkeys makes account takeover dramatically harder. Phase them in starting with the most security-sensitive accounts.

Frequently asked questions