Behind many desks in SME businesses hangs a sticky note with a password, stuck right onto the screen. Or there’s a scrap of paper tucked in a drawer. That isn’t carelessness on the part of the employee. It is the logical result of a password policy that gets enforced without anyone explaining why it exists. Any rule people don’t understand invites a workaround. And that workaround won’t show up in a report, because it plays out in people’s heads and desk drawers, not in a system you can monitor.
A rule without explanation invites a workaround
Twelve characters, one capital letter, one number, one special character, changed every ninety days. On paper that looks like a strict password policy. In practice it produces Welcome2024!, which ninety days later becomes Welcome2025!. Or a password that’s identical across three systems, because nobody can remember twelve different combinations. Employees aren’t lazy or careless. They solve a practical problem in whatever way works fastest for them. When that solution happens outside the policy, your business loses sight of what’s actually going on.
Measure first, before making anything mandatory
Before rolling out a new password policy, it’s worth looking at how employees currently handle passwords. Which ones get reused. Which systems are still running on a default password that was never changed. Whether a team is already quietly using a password manager, and why that particular team. Without that picture, you’re writing policy about something you can’t see, and you risk ending up with rules that fit reality just as poorly as the old ones. A short round of conversations and a scan of the key systems already gives you a realistic starting point.
Policy comes before technology
Only once you know where you’re starting from can you decide what policy makes sense for your business. A transport company with shifting rosters has a different reality than an office with fixed working hours. Technology, such as an enforced password length or multi-factor authentication, is the final piece, not the starting point. Anyone who fixes the technology first and only thinks about what’s workable afterwards ends up building a lock on a door without anyone understanding why it needs to stay shut.
Bringing people along before making anything mandatory
Explain what can happen if a password ends up in the wrong hands, not with a scare story but with an example close to your employees’ daily work. At a wholesale business, a shared password for the ordering system means anyone can place orders under a colleague’s name. Give people an alternative that makes doing the right thing easier, such as a password manager that removes the need to remember anything. Involve one team in testing new policy before rolling it out company-wide. People who feel heard are less likely to look for a way around it.
Demonstrable instead of based on a feeling
When you document the baseline measurement, the policy, and how you brought employees along, you have more than a gut feeling that things are fine. You have an overview that lets you work demonstrably towards NIS2, and that you can show an insurer or a client when they ask how you handle password behaviour. That overview doesn’t come from copying a policy document from another organisation. It comes from starting with what’s actually happening right now.
What you can do this week
Ask a few teams, not just ICT, how passwords are currently stored and chosen, without judgement. Map out which systems are still running on a default password. Check whether a password manager is already in informal use, and consider embracing it rather than banning it. Document what you find before announcing any new policy. That baseline measurement is the difference between policy people follow and policy people work around.
A few questions we’re often asked
Isn’t a password manager just a new risk in itself?
A password manager that your business chooses and manages is safer than a situation where everyone invents and remembers their own passwords. The risk isn’t in the tool itself, it’s in uncontrolled use of it. By including it in your policy and baseline measurement, you decide how it gets set up.
Should we stop forcing periodic password changes?
Forced periodic changes often backfire, because people start using predictable variations. Many businesses are better off with long, unique passwords combined with multi-factor authentication than with a change requirement. What makes sense for your business follows from the baseline measurement, not from a general rule of thumb.
How long does a baseline measurement take before we can build policy?
It doesn’t need to be a big project. A few conversations with teams and a scan of the key systems already give you a realistic picture within a few weeks. Speed matters less than making sure the policy you build actually fits how people really work.
What if employees keep sharing passwords even after the explanation?
Then it’s worth looking at why that’s still happening, for example because a system doesn’t allow separate user accounts. Sharing passwords is often a symptom of an underlying issue in how systems are set up, not just a behavioural one. Fixing that underlying issue usually removes the need for the workaround as well.
Curious what password behaviour actually looks like in your business right now? We’re happy to think along about a baseline measurement and a policy that fits daily practice.
