Start with rules staff can actually remember
The best password policy is the one people follow on a busy Monday morning, not just the one that looks neat in a file. Keep the rules direct: use unique passwords for every work account, never share them by WhatsApp or message, and change them when someone leaves the business or when a device is lost.
For a team in Woodstock, that might mean one rule for message, one for accounting software and one for stock or job systems. If staff are switching between laptops, mobile phones and shared office Wi-Fi, they need a simple habit that works under pressure. Long passphrases are easier to remember than short, complicated words, and they are much harder to guess.
Make length, not tricks, the main rule
Many small businesses still focus on forcing a mix of symbols, capital letters and numbers. That can help, but length matters more. A passphrase of 14 to 16 characters is a stronger practical target than a short word with a few extras bolted on.
Staff should avoid using family names, dog names, birthday dates or anything from a social media profile. In a South African business, local language words, cricket teams and street names can also be guessed easier than people think. A policy should explain the difference between a password that is merely different and one that is genuinely hard to crack.
- Use at least 14 characters for normal work accounts.
- Use a different password for every system.
- Avoid names, dates and predictable patterns.
- Store passwords only in approved tools, never in notes on a phone.
Tie passwords to access, not just memory
Password policy is not only about what staff choose. It should also show who gets access to what. A junior admin does not need the same rights as an operations manager, and the same login should not be used by three different people just because they are in the same office. That habit makes offboarding messy and creates gaps when someone resigns or goes on leave.
For a small company in Pretoria, this becomes important when teams are split between office work and remote work. If one account is shared across the whole accounts team, you cannot tell who approved a payment or viewed a client file. Separate accounts, role-based access and single sign-on help keep things clear without adding extra admin every day.
Build in basic checks for load-shedding and remote work
South African teams often work through load-shedding, unstable mobile signal and rushed handovers between office and home. A password policy needs to account for that. Staff should know how to log in from a second device, how to recover access if a phone battery dies, and who to contact when a code does not come through in time.
A practical policy also covers what happens when someone is travelling between Durban and Gqeberha or working from a coworking space. Public Wi-Fi should never be used for sensitive admin tasks unless the connection is properly secured and the device is up to date. If a login takes too long, people will start making shortcuts, so the process must be quick enough to use under real conditions.
- Keep recovery methods updated for each user.
- Require multi-factor authentication on key systems.
- Use a secure password manager for staff and admins.
- Lock devices automatically after a short period of inactivity.
Set a clean offboarding process from day one
One of the biggest password risks in a small business is not the password itself, but what happens when staff move on. If a person leaves and still has access to message, cloud storage or customer records, the business carries unnecessary risk. A solid policy should say that access is removed on the same day, or as close to it as possible, and that shared logins are replaced where needed.
This matters for seasonal staff, temporary contractors and part-time support workers too. The handover should include account lists, device returns and a check that all admin passwords have been changed. In coastal offices around Cape Town, humidity and hardware issues can complicate things, so do not rely on one laptop or one person knowing the login details. Keep the process written down and easy to follow.
Review the policy before it becomes a problem
A password policy should not sit in a folder untouched for years. Review it at least once a quarter, especially when the team grows, new software is added or roles change. A business with 8 staff has very different needs from one with 30, even if both are still small enough to move fast.
During a review, check whether staff are still using the right tools, whether any accounts are shared and whether the reset process is creating avoidable delays. If people are writing passwords on paper or reusing old ones because they cannot remember them, the policy is too complicated. The aim is stronger protection with less friction, not more admin for everyone.
For many local teams, the simplest policy is also the most effective: unique passwords, longer passphrases, proper access control and a clear way to remove access when needed. That is where daily security starts.
