How to choose and roll out a password manager for a small business

Most small businesses run on shared logins: the bank portal, the supplier site, the social media accounts, the Wi-Fi password taped to a monitor. A business password manager gives each person a private vault, lets you share specific logins without revealing them in an email or text, and lets you cut off access the day someone leaves. This guide covers how to choose one and roll it out to a team of five to 50 people.

The Canadian Centre for Cyber Security (Cyber Centre) supports password managers because they encourage long, unique passwords and discourage reuse. It is also frank about the risk: a password manager is a one-stop target, and if your account or the vendor is compromised, every stored password could be exposed. The steps below are built around reducing that risk.

Step 1: Decide what you need

Write down, in one page:

• Who needs access. Staff, the owner, an outside bookkeeper, a managed IT provider.
• What gets shared. Typical shared folders are Finance, Marketing and social media, Suppliers, and IT and admin.
• Which devices. Windows, Mac, iPhone, Android, and the browsers people use.
• How people sign in today. If you use Microsoft 365 or Google Workspace, single sign-on (SSO) with your existing accounts can simplify onboarding, but it is often a higher-priced tier.

Step 2: Compare products against the Cyber Centre checklist

The Cyber Centre's guidance on password managers (ITSAP.30.025) says to look for a product that:

1. supports multi-factor authentication (MFA) to unlock the vault;
2. encrypts passwords so that only you can read them, not even the vendor (often called zero-knowledge architecture);
3. flags weak or reused passwords and prompts you to change old ones;
4. alerts you when a stored password appears in a known breach or a site is compromised;
5. explains publicly how it protects your data;
6. works across your phones, computers and tablets.

For a business, add these to the list:

• Admin console with the ability to add and remove users, and to recover or transfer a departed employee's work items.
• Shared folders or collections with permissions (view only, can edit, can manage).
• Policies you can enforce, such as requiring MFA on every account and a minimum master password length.
• Activity or audit logs showing who opened or changed a shared item.
• Independent security audits published by the vendor (for example SOC 2 reports or third-party penetration tests), and a public record of how it handled any past incidents.
• Data residency and privacy terms. Under PIPEDA you remain accountable for personal information you hand to a service provider, so read where data is stored and what the contract says about breaches. Quebec businesses subject to Law 25 should also check the rules on transferring personal information outside Quebec.

Most established vendors offer a team or business plan and a free trial. Trial two products with two or three staff for a week before you buy.

What about the browser's built-in manager?

The Cyber Centre notes that browser-based managers are convenient but can be risky when other people use the same device, and do not always sync. Stand-alone managers tend to offer stronger protection, MFA and more features. For a business that shares logins, a stand-alone business product is usually the better fit.

Step 3: Set it up securely

1. Create the organization account with the owner as administrator, and add a second trusted administrator so you are not locked out if one person is unavailable.
2. Use a strong master passphrase. The Cyber Centre recommends a passphrase of at least four words and 15 characters, or a password of at least 12 characters with mixed character types.
3. Turn on MFA for the admin accounts, ideally with a security key or passkey, then enforce MFA for every user through the admin policies.
4. Set up account recovery. Read the vendor's recovery options carefully. Many zero-knowledge products cannot reset a forgotten master password, so print any emergency kit or recovery code and store it in a locked safe, as the Cyber Centre suggests for written passwords.
5. Create shared folders by role, and give each person the least access they need.

Step 4: Roll it out to staff

1. Hold a 20-minute session. Show staff how to install the browser extension and phone app, create a master passphrase and set up MFA.
2. Ask each person to import or add their work logins, and to let the manager generate new passwords for accounts that use weak or reused ones.
3. Move shared logins out of spreadsheets, sticky notes and chat threads into the shared folders. Then delete the old copies, including the spreadsheet in your cloud drive.
4. Explain the boundary between work and personal vaults. Many business plans include a personal vault for staff. Make clear what the business can and cannot see.
5. Set a deadline, about two weeks out, after which shared passwords are only given out through the manager.

Step 5: Decide what not to store

The Cyber Centre advises caution with your most sensitive accounts, such as banking and email, because a compromised vault would expose them. For a business, a reasonable approach is:

• Protect the business bank and payroll accounts with the strongest sign-in the bank offers, and limit them to the people who approve payments.
• If you do store those logins, keep them in a folder only the owner can see, and make sure the accounts themselves also require MFA so a password alone is not enough.
• Keep the password manager's own recovery codes offline.

Step 6: Offboarding and upkeep

1. When someone leaves, remove them from the password manager first, then change the passwords for every shared item they could see. Most products list those items for you.
2. Review the password health or security report monthly and fix weak, reused or breached passwords.
3. Keep the apps and browser extensions updated, as the Cyber Centre recommends.
4. Once a year, review who has admin rights and test that recovery works.

What to do if the vendor reports a breach

Read the vendor's notice to see what was taken. If encrypted vault data was stolen, change the master passphrase, then prioritize changing passwords for financial, email and admin accounts, and confirm MFA is on for each. Watch for phishing that uses the incident as a lure. If client personal information could be affected, assess your own breach reporting duties under PIPEDA.

Sources

• Canadian Centre for Cyber Security: Password managers: Security tips (ITSAP.30.025)
• Canadian Centre for Cyber Security: Secure your accounts and devices with multi-factor authentication (ITSAP.30.030)
• Canadian Centre for Cyber Security: Baseline cyber security controls for small and medium organizations