Password Manager Rollout for a Small Team

"We'll just use a spreadsheet"

I've walked into a lot of small businesses where the team's shared password situation is some version of an Excel file named passwords.xlsx, a Google Sheet shared with the whole team, or once, memorably, a printout taped to the inside of a cabinet door. Every one of those is a security disaster waiting to happen — not because the team is careless, but because every one of these setups breaks in predictable ways nobody plans for.

A real password manager — costing less than coffee per person per month — fixes the failure modes at once. Shared vaults that everyone on the team can use without anyone seeing the actual password characters. Personal vaults that belong to the employee, not the company. Onboarding a new hire in 10 minutes. Offboarding a departing one in 5. Audit trails that satisfy your cyber insurance. The math is cheap and the operational difference is enormous.

Three small-business stories that ended badly

• The Ravenna landscaper. Fired employee kept the Yahoo password, intercepted customer email, routed two snow contracts to a relative's new business. Cost: $7,800.
• The Kent salon. Receptionist kept the shared passwords in a Word doc on the front-desk Mac; her nine-year-old emailed it to himself "as a joke." Whole Saturday rotating credentials.
• The Aurora HVAC shop. A tech reused the shared Gmail password as his personal Netflix password. Personal email got phished, attacker tried the reused password at the shop's Gmail, sent fake invoices to three customers. One customer paid $4,200 to the wrong bank account.

The fix in all three would have been a password manager. The fix in all three would have cost less than $50 a month for the whole team.

What's in the 27-page PDF

• What a password manager actually is, in three plain-English sentences.
• Honest comparison of 1Password Teams, Bitwarden Teams, and Dashlane Team — pricing, setup ease, support quality, what each is best for.
• Bill's pick (1Password Teams for most, Bitwarden if budget matters) and the tradeoffs.
• The 5-minute boss buy-in conversation — the script that actually gets the owner to write the check.
• Team vault vs personal vault — what goes where, and why the employee's personal vault has to stay private even though the company pays the bill.
• The vault structure that scales to 20 people without becoming a mess (Personal, All Staff, Front Office, Money, Marketing, Operations).
• The admin role — who holds the keys, why you need at least two admins, the quarterly audit.
• Day 1 — onboarding a new employee in 10 minutes (the printable welcome packet checklist).
• Day 0 — offboarding when somebody leaves (the #1 security gap small shops have).
• Strong vs reused passwords — and why reuse is the actual problem.
• Master password recovery — the emergency kit, printed, in the safe.
• 2FA on top of the manager (mandatory, not optional) — authenticator app vs hardware key vs SMS.
• Sharing without texting — the SOP that takes 30 seconds.
• Browser auto-fill vs the app — when each is right, and the phishing safety net most people don't know about.
• Contractors, vendors, and one-off shares — three patterns, three solutions.
• The eight common mistakes Bill sees weekly, plus the fixes.
• The 30-day rollout checklist (Week 1: pick & set up. Week 2: invite the team. Week 3: move credentials in. Week 4: train and harden).
• The monthly password-health audit.

Why I wrote this

Most small-business password advice on the internet is written by Fortune 500 security consultants for IT departments that have an IT department. That's not us. A 4-person plumbing crew doesn't have an IT department; they have a busy owner and a Google Sheet they're a little embarrassed about. This guide is for that owner — the steps that work for 2-10 people, the tools that don't take a sysadmin to operate, the SOPs that survive after the consultant leaves. — Bill