Stop password reuse in your business, in one week

Preview: the checklist

From the BizStackReview team · Version 1, October 2026. Based on guidance from the ACSC, NIST and the UK NCSC. General information, not professional advice for your situation.

1. Today: protect the accounts that unlock everything (about 1 hour)

• List your 5–10 most important accounts: email, banking, accounting, cloud storage, website/domain, social media.
• Turn on multi-factor authentication (MFA) for each, starting with email. (It may be called two-step verification.)
• Choose an authenticator app, passkey or security key over SMS codes where offered. The ACSC calls SMS and email codes the least secure option.
• Make sure at least two trusted people can recover the critical accounts (email admin, domain, bank).

2. This week: set up a password manager (about 2 hours plus rollout)

• Pick a business password manager with shared vaults, admin controls and password health alerts. (Our comparison: bizstackreview.com/password-managers/)
• Protect it with a long, unique master password plus MFA.
• Create shared vaults by job (Finance, Marketing, Suppliers, Admin only), not one big shared folder.
• Invite every staff member. Each person gets their own account.
• Replace reused passwords with generated ones, important accounts first. Aim for 15+ characters where MFA isn't available (ACSC).
• Delete password spreadsheets, sticky notes and chat messages that hold logins.

3. Access: who can get into what?

• Write down every shared account and who uses it. Replace it with individual logins wherever the service allows.
• Give admin rights only to people who need them (the "least privilege" principle).
• Remove access for anyone who no longer needs it: ex-staff, ex-contractors, old agencies.
• Check that recovery email addresses and phone numbers on key accounts belong to the business, not to a former employee.

4. New starter checklist (repeat for each person)

• Create their own accounts. Never hand over someone else's login.
• Send a password manager invite and add them only to the vaults they need.
• Turn on MFA on their email and main tools on day one.
• Give them a 10-minute walkthrough: how to save, share and autofill logins.

5. Leaver checklist (do it on their last day)

• Remove their password manager access.
• Change every shared password they knew. The vault's sharing history helps you find them.
• Disable or transfer their email and app accounts. Forward their mail if needed.
• Remove their devices from your accounts and collect business devices.
• Check for access you might have missed: domain registrar, social media, banking, payment tools.

6. Monthly 15-minute habit

• Open the password health report and fix anything reused, weak or breached.
• Review who has admin rights.
• Don't force password changes on a calendar. NIST advises changing a password when there's evidence of compromise, not on a fixed schedule.

If something goes wrong

• Change the affected password from a clean device and sign out all sessions.
• Check your email for new forwarding rules or unknown logins.
• Tell your bank straight away if any payment details may be affected.
• Report it. In Australia: cyber.gov.au (ACSC). Elsewhere: your national cyber security agency.