Most password policies are well written and badly followed. Staff read the page, sign it, and then tape the password under the keyboard. The problem is rarely the employee. It is a policy that asks for something hard to remember and easy to guess at the same time.
Upper case, a number, a symbol, and a change every 30 days produces Ahmed123 followed by Ahmed124. Length matters more than complexity. Ask for a passphrase of four words or more that a person can remember and an outsider cannot guess.
A short personal sentence, adjusted so it is not a famous quote, works well. Length resists guessing, and ease keeps it off a sticky note.
The riskiest habit is one password across email, banking and work systems. A single leak from a small website opens every door. The practical fix is an approved password manager that generates and stores credentials, so each person remembers one strong passphrase.
Make the manager an official team tool, not a personal choice. That way protection becomes easier than the old habit, which is the only version that survives contact with a busy week.
A password alone is not enough. Turn on two-factor authentication for email, admin tools, and any system holding customer data. Prioritise the accounts that can change settings or export records.
Shared accounts are the quiet gap: an info mailbox, or a service account connecting two systems. Each service account gets a long random password, held by one named owner and recorded in a register. Sharing between employees ends: one person, one account.
The account most often forgotten belongs to someone who already left. Build a fixed exit step: disable the account, remove file access, rotate any shared password they knew, and end active sessions.
Then review access every six months with a simple sheet: account, who uses it, and whether it still needs to be open. A short review that happens beats a thorough one that does not.
A policy on paper enforces nothing. Compliance comes from three places: the system refuses weak choices in the first place, the manager explains the reason in one sentence, and the consequence for bypassing is clear from day one.
Explain what the rules protect: salaries, client files, reputation. People follow what they understand, not what they are threatened with.
Track three numbers: share of accounts with two-factor enabled, accounts with no known owner, and incidents that start with a stolen password.
In our security training at Q8DM, weak passwords rarely come from laziness. They come from rules that are hard to follow. Q8DM has worked in software, design and training since 1998. If you want access rules that people can actually keep, start at q8dm.com.