Cyber security for Irish small businesses

Passwords

A password manager for a small business: what to look for, and how to run one

A password manager lets every account have its own long password without anybody remembering it. For a business, the part that matters is what happens to the shared logins when somebody leaves.

By Oscar CobbeCurrent as at 5 minute read3 sources

Why a business needs one

A password used on two accounts is as weak as the less careful of the two sites. The UK's National Cyber Security Centre puts it plainly: if one account is compromised, an attacker can try the same password on the others. A password manager removes the reason people reuse passwords, which is having to remember them.

The NCSC's first step comes before any of that: turn on two-step sign-in, so a stolen password alone is not enough. Our guide to two-step sign-in on Microsoft 365 and Google Workspace covers the mailboxes, where it matters most, and our guide to cyber security for a small Irish business puts both alongside the other basics.

The browser's own, or a separate one

The NCSC says saving passwords in the browser is safe on your own devices, never on a shared or public computer, and only as secure as the device and the account behind it.

For a business there is a second question: whose account holds the passwords. Microsoft's page on its Edge password manager says it is available only with a personal Microsoft account profile, and that with a work account an IT admin may restrict it. Passwords saved to a person's own account leave with them. A password manager run on business accounts keeps the shared logins with the business.

What to look for

The NCSC's own questions are about devices, price and features. A business adds two of its own: who can see which logins, and what happens when someone leaves.

  1. 1It works on every device and system your staff use, which is the NCSC's first question.
  2. 2Shared vaults, so the logins a team uses (the website, the social media accounts, a supplier portal, the domain registrar) are shared through the manager, never in a spreadsheet or an email.
  3. 3An administrator who can remove a person and keep the vaults they used, which is what makes a leaver's last day routine.
  4. 4Two-step sign-in on the password manager account itself. The NCSC asks for it, so that the primary password alone does not open everything.
  5. 5A recovery route for a forgotten primary password. The NCSC mentions emergency access through trusted contacts; for a business, an administrator who can restore a person's access matters as much.
  6. 6Alerts when a saved password turns up in a data breach, and support for passkeys, which the NCSC now recommends as the first choice wherever a site offers them.
  7. 7A way to export everything, so changing product later does not mean typing every password again.

Rules for the passwords themselves

The United States' standards body, NIST, revised its guidance on passwords in July 2025 (SP 800-63B-4). Its rules for anyone who runs a sign-in page are a good policy for a small business too:

  1. 1At least 15 characters for a password that is the only thing protecting an account; at least 8 where it is one part of two-step sign-in.
  2. 2No rules about mixing character types: NIST says verifiers shall not impose them.
  3. 3No forced changes on a schedule. A password changes when there is evidence it has been compromised.
  4. 4Password managers, autofill and pasting allowed. NIST says verifiers shall allow password managers.

What this means in practice

Let the password manager generate long, random passwords for every account, and stop the routine of changing them every few months. Change one when it may have leaked, and every shared password a leaver knew when they leave.

Setting it up for a team

A password manager kept alongside the old spreadsheet is two places a password can leak from, so the set-up ends with the spreadsheet deleted.

  1. 1Choose one product for the whole business, on business accounts, and turn on two-step sign-in for every user from the start.
  2. 2Move the shared logins first: email administration, the domain registrar, the website, social media, banking portals and suppliers.
  3. 3Delete the old copies: the spreadsheet, the note on the shared drive, the emails with passwords in them.
  4. 4Write down the leaver steps: remove the person from the password manager, then change every shared password they could see.

Sources

  1. 1.Password managers: using browsers and apps to safeguard your passwords · National Cyber Security Centre (UK)
  2. 2.NIST SP 800-63B-4: Digital Identity Guidelines, Authentication and Authenticator Management · National Institute of Standards and Technology
  3. 3.View or edit your passwords in Microsoft Password Manager · Microsoft Support

Passwords, two-step sign-in and the rest, done once

Protect turns on two-step sign-in for every staff account and records it in a dated document, with SPF and DMARC, cookie consent, a privacy notice, a tested backup restore and a practised incident plan. From €2,950 up to 10 staff, fixed before we start.

Protect

Who wrote this

Oscar Cobbe · Founder, FourWinds Digital

Writes and maintains the legal explainers on this site, and does the compliance work behind them. Every date and article number here is checked against the legislation itself before it is published, and each article shows the date it was last checked.

More about how we work →

Read next

More on Cyber security for Irish small businesses

Written on 29 October 2026; it describes the law as FourWinds read it on that date. This is general information about how the rules work, not legal advice on your situation. Where you need a solicitor, we say so. How we check the law.