You have five employees. None of them has a dedicated IT role. One uses "Password1!" for the CRM. Another shares their login with a contractor over email. Your company data lives behind the weakest credential in your team.

Small businesses face the same cyber threats as enterprises but with a fraction of the security budget. The Verizon 2026 Data Breach Investigations Report found that 43% of cyber attacks target small businesses, and stolen credentials remain the primary attack vector at 53% of breaches. For businesses with 10 or fewer employees, the average cost of a credential-related breach is now $98,000 according to the IBM Cost of a Data Breach 2026 report.

The single most effective defence is a written password policy that every employee understands and follows. This guide walks you through creating one for your business, with specific requirements, enforcement tools, and templates you can implement today.

What Every Small Business Password Policy Must Include

Requirement	Minimum Standard	Recommended for 2026
Minimum password length	8 characters	12+ characters (NIST SP 800-63B)
Password complexity	Mix of types	No composition rules — favour length
MFA requirement	Optional	Mandatory on all accounts
Password expiry	90 days	Only on compromise (NIST guidance)
Password manager	Optional	Mandatory company-wide
Breach checking	None	Auto-check against HIBP
Shared credentials	Allowed	Forbidden — use secure sharing

The NCSC and NIST both updated their password guidance to remove mandatory periodic changes — unless a breach is known. The CISA guidance for small businesses emphasises length over complexity: a 15-character random passphrase is more secure and more usable than an 8-character "P@ssw0rd!" that employees will write on sticky notes.

Step 1: Choose Your Password Infrastructure

Before writing policy, decide what tools you will use to enforce it. For small businesses, the most practical approach is a company-wide password manager combined with multi-factor authentication. We cover the specific tools in our guide on password apps every small business needs.

Password Manager Requirements

Every employee should use a password manager. For small business teams, Bitwarden Teams and 1Password Business both offer affordable plans starting at $3-4 per user per month. They provide shared vaults for team logins, secure credential sharing, and breach monitoring. Keeper Business offers similar features with a focus on compliance reporting, which is useful if you operate in regulated industries covered by HIPAA, PCI-DSS, or ISO 27001.

Kaspersky Small Business Security also includes password management as part of its broader endpoint protection suite, which may be more cost-effective if you need both antivirus and password management in one license.

MFA Implementation

Multi-factor authentication is non-negotiable. CISA recommends that small businesses implement MFA on all internet-facing systems. Google Authenticator and Microsoft Authenticator are free and cover most business applications. For team-wide management, Duo Security offers a free tier for up to 10 users that integrates with hundreds of business apps.

Step 2: Define Password Requirements

Write clear, enforceable requirements that employees can actually follow:

Employee Password Rules

• Minimum 12 characters — generated by the company password manager
• No reuse of personal passwords for business accounts
• Passphrases of 4+ random words are encouraged for master passwords
• Never share credentials via email, chat, or written notes
• Report suspected compromise immediately
• No password reuse across different business applications

The OWASP Authentication Cheat Sheet provides detailed guidance on password policies that balance security with usability. Their key finding for small teams: complex rotation policies cause employees to create predictable password patterns, reducing rather than improving security.

Step 3: Enforce With Training and Audits

A policy is only effective if employees follow it. Schedule a 30-minute onboarding session for every new hire covering your password policy and MFA setup. Run quarterly audits using your password manager's built-in security reports — both Bitwarden and 1Password offer reports showing weak, reused, or compromised passwords across the organisation.

Hide My Name VPN provides an additional layer of protection for remote employees working from public WiFi. Combining VPN use with your password policy covers the two most common credential interception vectors: weak passwords and unsecured networks.

Step 4: Incident Response for Credential Breaches

Even with perfect policies, breaches happen. Your password policy should include a clear incident response procedure:

• Immediate: Reset the compromised credential and check for unauthorised access
• Within 1 hour: Notify all employees to change related passwords
• Within 24 hours: Run a full password audit across all business accounts
• Within 72 hours: Review logs for suspicious activity and update policy

The ICO requires breach notification within 72 hours for UK businesses under GDPR if personal data is affected. The ENISA guidance for SMBs recommends having a written incident response plan before any breach occurs — drafting one under pressure leads to missed steps and incomplete notifications.

The Real Cost of Skipping a Password Policy

Every week without a written password policy is a week your business data is exposed to credential-based attacks. The IBM Cost of a Data Breach 2026 study found that the average cost of a credential-based breach for businesses with under 50 employees is $98,000 — enough to put most small businesses out of operation. Implementing a password policy costs under $500 per year for a team of five, including a password manager subscription and MFA tools. The return on investment is effectively infinite because it prevents a single incident that would cost 200 times that amount.

The Cyber Essentials framework, developed by the UK government's NCSC, provides a five-step guide to basic cybersecurity that includes password management as one of its core controls. Businesses certified under Cyber Essentials receive reduced cyber insurance premiums and demonstrate to customers that they take data protection seriously.

For practical tips on avoiding the most common password mistakes, read our guide on why passwords fail and how to fix the weakest link. Every small business can implement these controls in a single afternoon, and the cost of not doing so is measured in thousands of pounds and potential business closure.

FAQs

Do I really need a written password policy for a 5-person team?

Yes. Without a written policy, there is no consistent security standard. Each employee follows their own judgement, and the weakest credential determines your risk level. A one-page policy takes an afternoon to write and prevents the most common breach scenarios. The NCSC Small Business Guide recommends starting with the five basic controls: password managers, MFA, patching, backups, and anti-malware.

What password policy is required for Cyber Essentials certification?

Cyber Essentials, the UK government-backed certification scheme, requires: multi-factor authentication on all internet-facing services, password managers for all accounts, and a minimum of 8-character passwords with no common patterns. The Cyber Essentials Plus level adds technical verification of these controls. Most small businesses can achieve basic certification in 2-4 weeks.

Should I require employees to change passwords every 90 days?

The NIST SP 800-63B standard no longer recommends mandatory periodic password changes unless a compromise is suspected. Research shows that forced rotation leads to weaker passwords (Season2026!, Month2026!) and increases support tickets for password resets. Instead, use breach monitoring to trigger changes only when a credential appears in a known breach.

How do I enforce password policy if employees use personal devices?

For BYOD environments, require that all business accounts are accessed through the company's approved password manager rather than stored in the device's browser. 1Password and Bitwarden both offer browser extensions that work on personal devices without compromising the company's security standards. Consider a mobile device management (MDM) solution if employees access sensitive data from personal phones.

Can a small business get cyber insurance with weak password policies?

Insurance underwriters increasingly require evidence of basic security controls. Most cyber insurance policies now mandate MFA, password managers, and regular security awareness training as conditions of coverage. Without a documented password policy and evidence of enforcement, many carriers will either deny coverage or apply significantly higher premiums. The CISA guidance on cyber insurance preparation recommends starting with password policies as a foundational requirement before applying for coverage.