Password Manager Rollout Checklist for Teams of 5–50

This checklist takes a team of 5 to 50 people from a shared password spreadsheet to a company password manager in six steps. It's written for the owner or office manager who keeps that spreadsheet today.

CISA lists strong passwords as one of its Four Cybersecurity Essentials for Businesses, and it names the tool directly: "A company-wide password manager makes it easier for employees to follow best practices. It generates complex passwords, fills them in and stores them securely."

How do small businesses roll out a password manager? Pick a tool with a business plan, pilot with three people, write shared-vault rules, migrate in waves, and remove access the day someone leaves. Retire the spreadsheet on a firm cutover date.

Do we still need MFA if we use a password manager? Yes. The manager helps everyone use unique passwords. MFA covers the case where a password still gets phished or exposed. Turn on MFA for the vault itself and for email, remote access, and every admin account.

Why a manager beats a spreadsheet

• Every login gets its own password. CISA defines a strong password as long, random, and "Unique: Used for only one account". Nobody can remember 40 of those. A manager can.
• Shared logins get named users. A vault entry shows who can open it. A spreadsheet in a shared folder doesn't.
• Access can be removed per person. When someone leaves, you take away their vault access instead of hoping they forgot the file.
• It's the storage CISA describes. Its Cybersecurity Performance Goals 2.0 say: "Credentials are stored in a secure manner, such as with a credential/password manager."

NIST's SP 800-63B-4 adds: "Password managers have been shown to increase the likelihood that subscribers will choose stronger passwords, particularly if the password managers include password generators."

A manager doesn't replace MFA. Step 4 covers that.

Step 1: Pick on requirements, not brand

This guide doesn't recommend a product. Write your requirements down first, then compare any tool against them.

• Business or team plan, not a set of personal accounts.
• Shared vaults or collections with per-person or per-group access.
• An admin console where you can add, suspend, and remove users.
• MFA on the vault sign-in, ideally with a security key or authenticator app. If you use Microsoft 365 or Google Workspace, check whether the vault can sign in through it.
• A recovery process that doesn't depend on one person's memory.
• Activity history, so you can see who opened or changed a shared entry.
• Export and offboarding controls, so you can leave the vendor and remove a user cleanly.
• Browser and phone apps for the devices your team actually uses.

NIST also says agencies "should carefully evaluate password managers before making recommendations or mandates to confirm that they meet expectations for secure implementation." The same goes for a 12-person office. Read the vendor's security page before you sign.

Step 2: Pilot with three people

Give it two weeks with a small group before anyone else sees it.

• Pick the three: the owner, the office manager, and one person who logs in to a lot of systems.
• Turn on MFA for each pilot vault on day one.
• Move their critical logins first: email, banking, payroll, the line-of-business app, and any vendor portals.
• Install the browser extension and phone app on each person's work devices.
• Keep a friction list. Write down every "where did that login go?" or "autofill didn't work" moment.
• Test recovery. Walk through what happens if one pilot user loses their phone.
• Decide go or no-go at the end of week two, using the friction list.

Step 3: Write company vault rules

Put these on one page and share it before the rollout. Keep it short enough that people read it.

Vault rules one-pager

• Personal vault: your own work logins that only you use.
• Shared vaults: logins more than one person needs, split by team (for example, Finance, Office, Marketing).
• Who can create shared entries: the owner, the office manager, or a named admin. Everyone else asks.
• Naming: use the vendor name and the purpose, such as "Bank – payroll login". Add the site address to every entry.
• No passwords in chat, email, or sticky notes. Share through the vault instead.
• New passwords come from the generator. CISA's guide says strong passwords are "At least 16 characters long (more is better)".
• Change default passwords on new devices and apps before use, as CISA's guide says to.
• Admin accounts are separate from everyday accounts. CPG 2.0 says "system administrators and service/machine accounts have unique passwords that differ from those of regular user accounts."

How do we stop shared spreadsheets of passwords? Move every shared login into a vault with named users, stop adding to the spreadsheet, and set a cutover date. For shared email, use a Microsoft 365 shared mailbox with permissions instead of a shared password. The Microsoft 365 admin hygiene guide covers that cleanup.

Step 4: Pair with MFA, never replace it

A password manager makes passwords better. It doesn't make MFA optional.

Microsoft's MFA guide for Microsoft 365 explains why: "Even if a strong user password is compromised, the attacker doesn't have the user's smart phone or fingerprints to complete the sign-in."

• MFA on the vault itself. The vault holds every other password, so its sign-in gets your strongest method.
• MFA on email, remote access, and file storage. CISA's guide says to "turn on MFA across systems like email, file storage and remote access."
• MFA on every admin account, including break-glass admins. CISA: "Enable MFA on all admin accounts and for employees who handle sensitive data." Emergency accounts are admin accounts. Give them a security key kept in a safe place instead of skipping MFA.
• MFA on banking and payroll, using whatever the bank offers.
• Check Microsoft 365 coverage. Microsoft's security defaults "Require MFA for administrator accounts at every sign in." Confirm they're on, or that Conditional Access does the same.

Use the MFA setup guide to turn it on and the MFA coverage drill to check that nobody was missed.

Step 5: Roll out in waves

Move everyone else in groups, one group per week.

Rollout timeline

• Run a 15-minute huddle per wave: install, set up MFA, save one login together.
• Answer questions in one place so fixes reach the next wave.
• Announce the cutover date at the start of wave 1.
• On cutover day, change every password that was in the spreadsheet, save the new ones in the vault, then archive the file where nobody else can open it.

Step 6: Remove vault access the same day someone leaves

Vault access goes on the same offboarding checklist as email and remote access.

Offboarding snippet

• Suspend or remove the person in the password manager admin console.
• Disable their email and remote access at the same time.
• Change the passwords for shared entries they could open, starting with banking, payroll, and admin logins.
• Check the activity history for recent exports or changes.
• Write down the date and who did each step.

If an IT provider handles accounts for you, ask how they do this. The questions to ask your IT host include offboarding.

Common stalls and fixes

• "We'll do it later." Put the pilot start date on the calendar today. Two weeks with three people is a small ask.
• The spreadsheet keeps coming back. Set the cutover date, change the passwords on it, and archive it.
• One person owns the master account. Add a second admin and write down the recovery steps.
• The vault has no MFA. Turn it on before you move another login.
• Shared logins with no owner. Give every shared vault a named owner who reviews it each quarter.

Related guides

• MFA setup for small business Microsoft 365
• MFA coverage drill
• Microsoft 365 admin hygiene
• Questions to ask your IT host
• Houston SMB CISA fixes checklist
• Month-end SMB security hub
• Resources