- Businesses & Employers Hub
Start with the accounts your team needs every day, then choose a password manager that works on their actual devices. The NCSC recommends saving passwords securely on a device or browser, or using a password manager, rather than trying to remember different passwords for every important account.[6]
For a small employer, begin with one ordinary job: opening the bookings system or responding to an enquiry. This is a practical starting point for a conversation with your IT contact, not a product recommendation or instructions to move every login at once.
Find the accounts behind the working day
Ask a colleague to show you which services they use during a normal shift. Record the service name, who needs access and who looks after it. Keep passwords out of this working note. Include the less obvious accounts, such as the supplier ordering portal or the website renewal account that only gets opened occasionally.
Check whether people already have individual accounts or borrow a common login. Scottish Government guidance explains that individual user accounts let businesses give staff their own access and restrict sensitive information.[1] Ask your IT contact whether the service supports a separate sign-in for each person before deciding how to organise passwords.
Name the person who will answer questions during the change. In a team without a dedicated IT department, that might mean arranging an appointment with the existing support provider. Avoid making the colleague who remembers the most passwords responsible for the entire project by default.
Try it on the devices people actually use
The NCSC describes built-in device managers, browser managers and separate password manager apps as options. It notes that an app can suit people using different browsers or device types.[6] Begin with that practical distinction rather than a long comparison of brand names.
Ask whoever is helping you to demonstrate the proposed option on the work laptop and any other authorised work device. Could the person covering reception use it comfortably? Does it work in the browser your booking software requires? Have staff try a harmless test account before moving an important live login.
Use the demonstration to raise everyday questions. Ask what the business would pay for the number of people who need access, which features are included and how support works. Get the current terms from the supplier rather than assuming a free personal account includes the arrangements your business needs.
Keep separate access separate
A password manager is not a reason to give everyone the owner’s credentials. Government business guidance recommends unique passwords, multi-factor authentication where available and avoiding passwords shared between users.[3] Ask for an access plan alongside the demonstration.
For each service, explain the task someone needs to perform. A colleague replying to enquiries may not need the permissions used to change account settings. Ask your IT contact how the service supports that distinction, including what happens when someone changes role.
If an older service appears to require a common login, pause before putting it into a shared vault. Ask the provider what authorised options exist and how access can be withdrawn. Record the unresolved question and who is following it up, rather than quietly treating a shared password as the finished solution.
Plan recovery before the first real move
Ask what would happen if the person managing the setup lost their phone or could not come to work. Have your IT contact explain the recovery route for your chosen arrangement, including who is authorised to use it. Keep recovery secrets out of general staff notes and ask where they should be held securely.
For a manager protected by a master password, the NCSC says that password should be strong, unique and unrelated to personal information.[6] Ask staff to follow the chosen service’s setup instructions. Nobody should have to read their master password aloud during a training session.
Government guidance also recommends reviewing who can access business accounts and removing access that is no longer needed.[3] Ask how your password manager review will fit the existing process for starters and leavers, rather than becoming another task that depends on somebody remembering.
Start small and check the next shift
Choose one low-risk account with your IT contact and agree a supported trial. Do not delete existing access methods or move critical accounts until the responsible person has explained the change and recovery arrangements. Ask the next authorised colleague to try signing in themselves, not just watch the demonstration.
Write down what worked and the questions still open. This week, make the account inventory, book the demonstration and choose who will follow it through. The MH360 Businesses & Employers hub has more practical reading for the people behind a small business.
Sources
[1] Password security and user accounts
