Reviewed and updated on 20 October 2026.
Account security depends on everyday habits as well as technical controls. These four checks give staff and IT teams a clear place to start.
1. Use a different password for each account
Use long, unique passwords and an approved password manager to generate and store them. Where a password needs to be memorable, the NCSC recommends three random words. Avoid company names, personal details and predictable substitutions.
2. Change passwords when there is a reason
A calendar reminder to change every password can encourage predictable changes. The NCSC advises against routine forced password expiry. Change a password promptly if it may have been exposed, reused or compromised, and have IT investigate the account.
3. Keep access aligned with each person’s role
Give people individual accounts. Review permissions when responsibilities change and remove access when it is no longer needed. Include shared services, remote access and third-party applications in your leaver process.
4. Enable multi-factor authentication
MFA adds a further check when someone signs in. Use the strongest suitable method your service supports and protect account recovery options. Never approve an unexpected sign-in request or share a verification code with someone who contacts you.
Ask your IT team to check whether these controls cover business email, administrator accounts and remote access. CIS can help review account protection as part of our cyber security services.
