Strong Passwords Need More Than Clever Substitutions
Review password reuse, business password managers, MFA and recovery ownership before a stolen password becomes a wider account problem.
· Last updated
A clever substitution doesn't fix the bigger password problem, which is reuse. Give every account its own long, random password, keep them in a password manager your business approves, and turn on multifactor authentication (a second step at sign-in). Then review who can recover each important account.
Key Takeaways
- Use a different password for each account.
- An approved password manager can support long, randomly generated passwords.
- Protect account recovery and MFA as well as the password itself.
This guide was originally published on 2020-08-07. Its guidance was substantially updated on October 2, 2026.
Replace reuse with an approved process
CISA recommends long, random and unique passwords and the use of a password manager. For a business, choosing the tool also means deciding who administers it, how employees join and leave, and how access to shared credentials is controlled.
Do not ask employees to send existing passwords through a contact form or spreadsheet to begin an assessment. Start with an inventory of accounts and ownership. Sensitive details need an appropriate secure process.
Review shared access separately
Where a service supports individual accounts and delegated access, consider those options before sharing one login. If a shared credential is necessary, document who needs it and how access changes when someone leaves.
A password manager is not a substitute for deciding who should have access. The business still needs an approver and a process for removing permissions when a role changes.
Protect recovery and sign-in approval
Add appropriate multifactor authentication and review the recovery methods attached to important accounts. An obsolete phone number or a personal recovery address can complicate business access when an employee is unavailable.
Tell staff how to report unexpected sign-in prompts and what to do if they believe a credential was exposed. Do not assume that using a strong password makes a request to approve access trustworthy.
Start with the accounts whose loss would interrupt business operations. Email, domain administration and financial systems often deserve an early ownership review, followed by the other applications your team depends on.
Talk through the next step
Cyber Shift has 98% client retention across 235+ businesses served since 2016. Book a 30-minute call with our North Canton team about passwords, password managers and MFA for your staff.
Reference: official guidance.