Run the checklist. See what comes next.

Make every password unique

Do not reuse a password or passphrase across services. Start with email, administrator, finance, domain and backup accounts.

Use long passphrases

Where MFA is unavailable, use at least four unrelated random words and aim for at least 15 characters. Follow the service’s length and character requirements.

Use a reputable password manager

Generate and store unique credentials in a password manager. Protect its master account with MFA and a strong, unique passphrase.

Enable MFA on high-value accounts

Start with email, identity, administrator, remote-access, financial and password-manager accounts. Prefer stronger available methods.

Stop shared accounts where possible

Create an individual account for each person so activity can be attributed. If sharing is unavoidable, document access and use MFA.

Separate daily and administrator identities

Use a standard account for everyday work and a separate administrator identity only when elevated access is required.

Remove stale access promptly

Disable accounts and revoke sessions when staff leave or change roles. Review vendor and service accounts on a regular schedule.

Protect account recovery

Secure recovery email addresses, phone numbers, backup codes and help-desk verification processes with the same care as the account.

Disable legacy authentication

Where your provider supports it, remove older sign-in methods that bypass modern MFA and apply provider security policies consistently.

Make reporting easy

Tell staff how to report a suspected credential compromise. Reset affected credentials, revoke active sessions and investigate before restoring access.