Sample password policy for small business: a short, modern template you can copy today

What should a small business password policy include?

A useful policy is short enough that people read it and specific enough that they can follow it. For most small teams that means one page covering:

• How long passwords must be, and that each account needs its own.
• When passwords must be changed.
• Where multi-factor authentication is required.
• How passwords are stored and shared.
• What to do when someone joins, changes role or leaves.
• How to report a suspected compromise.

The template below follows the direction of NIST SP 800-63B, the US National Institute of Standards and Technology's digital identity guidelines. It is widely used as a reference by organisations of every size.

What does NIST SP 800-63B recommend for passwords?

The guidance moved away from the old "8 characters, one symbol, change every 90 days" approach. In plain terms, it recommends:

• Length over complexity. Allow long passwords and passphrases, and do not force arbitrary mixes of symbols and numbers.
• No routine forced changes. Require a change when there is evidence of compromise, not on a fixed calendar.
• Screen against known-bad passwords. Reject passwords found in breach lists, dictionary words and obvious patterns.
• No password hints or knowledge questions such as "first pet's name".
• Allow paste and password managers, so people can use long, random passwords.
• Use multi-factor authentication where the risk justifies it.

Read the current version of the document itself for the exact requirements, as it is updated over time. The CISA and OWASP guidance on authentication points in the same direction.

Sample password policy: a copy-paste template

Replace the bracketed parts with your own details.

1. Purpose and scope

This policy protects [Company]'s accounts and data. It applies to all employees, contractors and anyone given access to company systems or shared accounts.

2. Creating passwords

• Passwords must be at least [15] characters. Longer is better. Passphrases of several random words are allowed.
• Every account must have its own unique password. Reusing a password across sites is not allowed.
• Do not use names, birthdays, company names, keyboard patterns or common words on their own.
• Use the approved password manager's generator wherever possible.

3. Changing passwords

• Passwords are not changed on a fixed schedule.
• A password must be changed immediately if it appears in a breach alert, was shared outside the approved password manager, was entered on a suspicious site, or if a device holding it is lost.
• Shared passwords must be changed when someone with access leaves or moves role.

4. Multi-factor authentication

• MFA is required on email, banking and finance, domain and DNS, cloud hosting, payroll, social media and the password manager itself.
• Authenticator apps are preferred over SMS codes where the service supports them.
• For shared accounts, the authenticator secret is stored in the approved password manager, not on one person's phone.

5. Storing and sharing passwords

• All work passwords are stored in [approved password manager].
• Passwords must never be sent by chat, email or text message, or kept in spreadsheets, documents or notes.
• Shared access is granted per item or folder, at the lowest level needed.
• Do not save work passwords in personal browser profiles.

6. Breach screening

• Passwords are checked against known breach lists using the password manager's health or breach feature, and flagged passwords are changed.

7. Joiners, movers and leavers

• New staff receive access through the password manager on day one.
• Access is reviewed when someone changes role.
• Leavers are offboarded using the password offboarding checklist on their last day.

8. Reporting

• Report any suspected compromise, phishing attempt or lost device to [name or role] at [contact] straight away. Reporting quickly is never punished.

Policy owner: [name, role]. Review date: [date].

Why drop forced password changes every 90 days?

Calendar-based changes sound safe but tend to produce weaker passwords. People make small, predictable edits, such as adding a number at the end, and often write the new one down somewhere insecure.

The better trigger is evidence: a breach alert, a lost device, a phishing click, a password sent in chat, or a person with access leaving. That is why the template ties changes to events, not dates. If a regulator, insurer or customer contract you work under demands periodic rotation, follow that requirement and note it in the policy.

What does a strong password policy require?

Two approaches satisfy the template, and both are easy with a password manager.

• Random generated passwords of around 20 characters for every website and app. Nobody needs to remember them, because the password manager fills them.
• Passphrases of four or more random, unrelated words for the few passwords people must type from memory: the password manager's master password, the computer sign-in and the main email account.

What does not count: a common word with a number and symbol added, a password used anywhere else, or a variation of an old password. Those are exactly what breach lists and guessing tools try first.

The master password deserves extra care. It protects everything else, so it should be long, unique, never written in a shared place, and protected by MFA where the tool supports it.

How do you roll out the policy without a revolt?

1. Start with the tool, not the document. Set up the password manager first, so the policy describes something that already works.
2. Migrate shared accounts together. Run a short session where the team imports and organises shared logins.
3. Turn on MFA for the critical list in section 4, account by account.
4. Run a breach check and change anything flagged.
5. Publish the one-page policy and ask each person to confirm they have read it.
6. Review it yearly, or when you add a major system.

Where does BobWork Vault fit, and where doesn't it?

To be clear about limits: BobWork Vault does not enforce a password policy. It will not block a short password, force MFA on members or remind people to rotate on a schedule. The policy is still a written agreement your team follows.

What it does is make the policy easy to follow. It is a free team password manager that offers a 20-character generated password on sign-up forms, runs breach alerts and password health checks through Have I Been Pwned using k-anonymity (only the first five characters of a SHA-1 hash leave the browser), and stores authenticator secrets so it can fill the 6-digit 2FA code after the password. Sharing per item or folder, with Owner, Edit, View or Login only access, covers section 5, and the guided offboarding flow supports section 7.

See the security page for how encryption works, or create a free team vault to use as your approved password manager.

Try BobWork Vault — free for your whole team

BobWork Vault is a free, zero-knowledge password manager for teams, made by BobWork (BobOffice, LLC). Shared folders, login-only access, 2FA codes and guided offboarding, end-to-end encrypted. Add it to Chrome or create a free account.

Keep reading

• Employee offboarding checklist: what to revoke, rotate and hand over
• How to share passwords securely with your team (and stop pasting them into chat)
• How BobWork Vault encrypts your passwords
• Team password managers compared

More: free team password manager · free company password manager · company password manager · password management software · how to share passwords with teammates · compare password managers