How to Write a Password Policy Your Employees Will Actually Follow

Why most password policies fail

A policy that nobody follows is worse than no policy, because it creates a false sense of safety. The classic version demands eight characters with a capital, a number and a symbol, changed every 90 days. People respond predictably: Summer2026! becomes Autumn2026!, and the same password gets reused across systems.

Good policy starts from how people behave. If the rule is hard to follow, they will find a workaround. Your job is to write rules that are simple, explain the reason, and are supported by tools.

Core rules for a modern policy

Keep the written policy short enough to fit on one page. The following points cover the essentials for most small businesses.

• Use long passwords or passphrases, with a minimum length you can state clearly
• Every account gets a unique password, never reused across services
• Store passwords in the company password manager, not in browsers, notes or spreadsheets
• Turn on multi-factor authentication wherever it is offered, starting with email and admin tools
• Reject passwords that are common or known to be in public breaches
• Never share passwords by email or chat; use the manager's sharing feature

What to retire

Dropping outdated habits is as important as adding new ones. Mandatory rotation every few weeks, composition rules that produce predictable patterns and security questions with guessable answers can all be removed without making you less safe.

Instead, change a password when there is a reason: a suspected phishing click, a lost device, a breach notification or an employee departure. This approach focuses effort where it matters and reduces frustration.

Make the password manager the default

A password manager is what makes a strong policy realistic. Nobody can remember dozens of unique 16-character passwords, but nobody has to if the manager fills them in. Choose a business plan with an admin console so you can invite and remove users, set policies and see which accounts are weak or reused.

Roll it out in stages. Start with a small group, move shared accounts first, and then set a deadline for everyone. Give a short training session and a one-page quick-start guide, because most resistance comes from not knowing how it works.

Handle the awkward cases

Every business has exceptions that a policy needs to address, or people will invent their own rules.

• Shared accounts such as social media: use shared vaults and MFA that goes to a managed device or authenticator
• Contractors: give time-limited access and remove it when the work ends
• Devices that cannot use MFA: isolate them and use the longest password the system allows
• Master password: make it a long, memorable passphrase and never store it digitally in plain text
• Recovery: record how admin recovery works and who holds the emergency access

A starter policy you can adapt

If you need a place to begin, the wording below can be adapted to your size and tools. Keep the tone plain and avoid legal language that nobody reads. The aim is behaviour, not paperwork.

Company accounts must have a unique, long password or passphrase, generated and stored in the company password manager. Multi-factor authentication is required on email, finance systems, administrator accounts and any service holding customer data. Passwords are never shared by email or messaging. Passwords are changed immediately if compromise is suspected, and when a person with knowledge of a shared password leaves the business.

Add a line describing who to tell if something goes wrong, such as a suspected phishing click, and promise that reporting a mistake quickly will never be punished. The speed of reporting is often what decides whether an incident stays small. Pair the written document with a ten-minute briefing so that questions can be asked in person.

How to measure whether it is working

Choose a few simple indicators and review them every quarter. They show whether the policy is a living practice or a forgotten file.

• Percentage of staff accounts with multi-factor authentication enabled
• Number of weak, reused or breached passwords reported by your password manager
• Time taken to remove access when someone leaves
• Number of staff who have completed the password manager setup
• Number of incidents reported early by employees

Roll it out and review

Announce the policy with a short explanation of why it changed, particularly if you are dropping forced rotation, because people may assume that you have lowered your standards. Provide a clear route for questions and a named person responsible.

Review the policy once a year and after any incident. Check whether MFA coverage is complete, whether leavers were removed promptly and whether the password manager reports a lot of weak entries. Small adjustments based on real data keep the policy useful rather than ceremonial.