Password management for UK businesses: beyond the spreadsheet

Why the current approach fails

• The same password reused across work and personal services
• Shared logins for finance, social media and supplier portals in a spreadsheet
• Credentials pasted into chat threads and never rotated after someone leaves
• Browser-stored passwords syncing to unmanaged personal devices
• Forced 90-day rotation producing predictable, weaker passwords

What a business password manager changes

Every account gets a unique, long, generated password nobody needs to remember. Shared credentials live in role-based vaults rather than a spreadsheet, so access is granted and revoked centrally. Offboarding becomes a single action instead of an archaeology exercise, and you gain a defensible audit trail.

Passkeys and phishing-resistant MFA

Passkeys remove the password from the equation for supported services and cannot be phished the way a code can. Adoption is uneven, so plan for a mixed estate: passkeys where they are supported, app-based MFA with number matching elsewhere, and SMS only as a last resort.

Rolling it out so people actually use it

• Deploy to a pilot group and fix the awkward applications first
• Import shared credentials into role-based vaults before asking users to switch
• Enforce MFA on the password manager itself, without exception
• Rotate every shared credential during the migration, especially the old ones
• Train on browser and mobile use, because that is where adoption is won or lost
• Monitor the built-in breach and reuse reports monthly and act on them

How this maps to Cyber Essentials

Cyber Essentials expects unique credentials, MFA on cloud services, prompt removal of leavers and a defensible password policy. A password manager, combined with the leaver process it enables, is the simplest way to evidence all of those without inventing paperwork.