Many small businesses still run on password rules from the early 2000s: eight characters, one capital letter, one symbol, change it every 90 days. The result is predictable. Staff write passwords on sticky notes, reuse the same one everywhere and add "!1" each quarter. The National Institute of Standards and Technology (NIST) updated its digital identity guidelines in August 2025, and the new advice is both more secure and easier to live with.
What NIST SP 800-63B Revision 4 says
- Length beats complexity. When a password is the only thing protecting an account, it should be at least 15 characters. Systems should allow at least 64 characters, including spaces, so people can use passphrases.
- No composition rules. Requiring a mix of uppercase, numbers and symbols is out. Those rules push people toward predictable patterns.
- No forced periodic changes. Passwords should be changed when there is evidence of compromise, not on a calendar.
- Check against breached passwords. New passwords should be screened against lists of commonly used and previously leaked passwords.
- Password managers and paste are welcome. Sign-in pages should allow pasting so people can use password managers.
- Passkeys are recognized. Syncable passkeys, the kind stored in a phone, computer or password manager, are accepted as a strong sign-in method.
NIST writes these guidelines for federal agencies, but they are widely used as the benchmark for everyone else, including by insurers, auditors and frameworks such as the FTC Safeguards Rule and HIPAA risk assessments.
This article is general information, not legal advice. If you are subject to a specific regulation, confirm its requirements with your attorney or compliance advisor.
Why a business password manager matters
Nobody can remember a unique 15-character passphrase for every account. A business password manager solves that:
- It generates and stores a unique password for every site and app.
- It lets you share logins for shared accounts, such as a supplier portal or social media, without sending passwords by email or text.
- When someone leaves, you remove their access in one place.
- Most alert you when a saved password shows up in a known data breach.
Choose a business plan, not personal accounts, so the company owns the vault and controls access.
Passkeys: the next step
A passkey replaces the password with a cryptographic key stored on your device, unlocked with your fingerprint, face or PIN. Because there is nothing to type, there is nothing to phish. Microsoft 365, Google Workspace and many banking and accounting services already support passkeys. Turning them on for key accounts is one of the most effective upgrades a small business can make, and CISA recommends phishing-resistant multi-factor authentication wherever it is available.
A rollout plan for a small team
- Update your written policy to require long passphrases, remove composition rules and drop forced 90-day changes.
- Turn on multi-factor sign-in for email, banking, payroll, accounting and remote access first.
- Roll out a business password manager and spend 30 minutes helping each person move their work logins into it.
- Enable passkeys on Microsoft 365 or Google Workspace and on any other key service that supports them.
- Change any reused or breached passwords the password manager flags.
- Plan for recovery: make sure at least two people can regain admin access if a phone is lost or someone leaves.
How we help
Bitnode Technologies helps US small businesses modernize sign-in security: password policy updates, business password manager rollout, multi-factor authentication and passkeys on Microsoft 365 and Google Workspace, with remote support nationwide and on-site visits by arrangement. Book a free 30-minute consultation and we will review how your team signs in today and map out the quickest improvements.
Useful references
- NIST SP 800-63B-4: Authentication and Authenticator Management, National Institute of Standards and Technology
- Secure Our World, CISA
- Implementing Phishing-Resistant MFA, CISA
- Cybersecurity for Small Business, Federal Trade Commission
Cover photo by Towfiqu barbhuiya on Unsplash.