Choose a password manager your team can operate safely

Choose a password manager by how your team will own, recover and share access. A secure-looking application can still be poorly operated if its only administrator leaves or recovery is misunderstood.

Start with the account ownership problem

Identify which accounts belong to the organisation and who currently controls them. A domain registrar, payment provider or supplier portal may depend on one person’s private email or a password stored in a chat thread. Those ownership issues deserve attention before a tool migration.

Separate personal accounts from business accounts. Staff should understand what the organisation administers, what belongs in shared business storage and which private credentials must remain outside it. Agree the boundaries before importing existing records.

Use a selection worksheet

Area	What to verify for the actual product and plan
Administration	Named roles, permission boundaries and a backup owner.
Recovery	How an authorised user or organisation regains access.
Sharing	Controlled group access rather than uncontrolled copies.
Authentication	Supported strong sign-in methods for the vault itself.
Lifecycle	Onboarding, role changes and departure handling.
Export and exit	How authorised records can be transferred if the service changes.
Visibility	Available activity and access records appropriate to the need.

Test recovery before relying on the tool

Use a controlled exercise with noncritical sample records and the provider’s current instructions. Confirm what the user and administrator can recover and what they cannot. Do not assume a forgotten master credential is always reversible.

Keep recovery material through the organisation’s approved secure method, with access limited to authorised people. A printout left in an open drawer or a screenshot in a shared mailbox can undermine the intended protection.

Make sharing an access decision

A shared credential should have a reason, an owner and an audience. Where a service supports named user accounts, prefer the accountability of those accounts rather than using a password manager to normalise one account for everyone.

When someone changes role or leaves, review their access to the vault and the underlying services. Removing a person from a shared folder does not necessarily change a password they already knew. Follow the organisation’s approved process for any necessary credential rotation.

Introduce the workflow to the team

• Show how to create and retrieve an approved business record.
• Explain which information must stay out of shared notes.
• Demonstrate the reporting route for suspected exposure.
• Practise a lost-access scenario using safe sample data.
• Review unused accounts and sharing groups periodically.

CISA promotes strong passwords and password managers as part of safer account practices. Product selection still needs current documentation and an operating plan; this guide does not endorse a particular vendor or promise that one tool removes every account risk.