Guide

The Perimeter is Gone: Password Best Practices for Remote SMBs Teams

As SMBs move to permanent remote or hybrid work, the traditional corporate perimeter has gone, and the password is often the first and only line of defense. These are the password best practices that hold up for a remote team.

By SecureBusinessHub Editorial, International cybersecurity desk · 2025-10-08 · 8 min read

The myth of the complex password

For years, the advice was complex passwords with special characters and numbers, like P@ssw0rd!. They're hard to remember and modern brute-force tools crack them quickly anyway. The better approach is passphrases.

A passphrase is a string of random words, something like correct-horse-battery-staple. It is longer, mathematically harder to crack, and easier to remember.

The end of forced rotation

Mandatory password changes every 90 days are counterproductive. When forced to change passwords frequently, users default to predictable patterns like Password01, Password02. Current NIST guidance says only change a password when there's evidence of compromise.

Centralized credential management

Remote employees access dozens of SaaS tools. Expecting them to remember unique, strong passwords for each one leads directly to password reuse, and one breached service then exposes every other account that shares the same password.

Use centralized password managers like Bitwarden or 1Password. These tools handle credential sharing securely, generate strong passwords automatically, and give you an audit trail. To make these habits stick across a whole team rather than relying on individual willpower, write them into a password and MFA policy that everyone follows.

MFA is not optional

A strong password alone isn't enough. MFA must be enforced across all corporate accounts. But not all MFA is equally strong.

SMS vs. authenticator apps

SMS-based MFA is vulnerable to SIM-swapping attacks. TOTP apps like Google Authenticator or Microsoft Authenticator generate codes locally on the device, so an attacker can't intercept them over the cellular network.

Hardware security keys: the FIDO2 standard

For high-privilege accounts, standard MFA can still be defeated by adversary-in-the-middle phishing. FIDO2 hardware keys like YubiKey or Google Titan close that gap. They require a physical touch and will only authenticate with the exact domain they were registered to, so a fake login page gets a useless response.

For IT administrators, finance staff, and anyone with owner-level access to critical platforms, hardware keys are the current security standard.

Zero-Trust and session management

Password security extends to how those credentials are used. In a remote environment, apply Zero-Trust principles: require MFA for every new session and set realistic timeouts, so a session left open on a stolen laptop does not stay usable.

Employee training

Tools handle the mechanics, and training builds the habits. Hold regular sessions on spotting phishing attempts, and make it safe for employees to report a lost device or a suspected credential leak without fear of punishment.

NIS2 requirements: the second regime to know about

Data protection law is not the only European regime a business gets asked about. The NIS2 directive sets baseline cybersecurity and incident-reporting obligations for organisations in a defined list of sectors, and it is the source of most of the security questions that now arrive attached to contracts. The two regimes cover different ground: data protection law governs personal data and what people can ask you to do with it, while the NIS2 requirements govern the security and resilience of network and information systems, whether or not personal data is involved. A single incident can engage both, on separate clocks, to separate authorities.

The directive applies to organisations in its listed sectors that are at least medium-sized, meaning broadly fifty or more employees or turnover and balance sheet above ten million euros. Under that size rule, a ten-person company is usually not regulated by the directive at all. The requirements can still reach you, because one of them is supply chain security: organisations inside scope are expected to consider the security practices of their direct suppliers, and in practice that expectation arrives as a questionnaire in your inbox.

The measures the directive names are a reasonable checklist for any business, which is why they are worth knowing even when they do not apply to you directly. They cover risk analysis and written security policies, incident handling, business continuity and backups, supply chain security, secure development and vulnerability handling, basic cyber hygiene and training including for management, encryption and access control policies, and multi-factor authentication. Reporting is staged and fast for the organisations it covers: an early warning within twenty-four hours of becoming aware of a significant incident, a fuller notification within seventy-two hours, and a final report within one month.

Because the directive is national law in each member state rather than a single rulebook, the details of scope, thresholds and reporting differ by country. For a fuller explanation of the instrument itself, see our guide to what the NIS2 directive is, and for the supplier side of the supply chain obligation, our walkthrough of vendor risk assessment. The reporting clocks that run alongside data protection deadlines are covered in data breach notification requirements.

Frequently asked questions

Does NIS2 apply to a small business?

NIS2 generally applies to organisations in its listed sectors that are at least medium-sized, meaning broadly fifty or more employees or turnover and balance sheet total above ten million euros. A smaller business falls outside its direct scope unless a member state has specifically designated it or it sits in one of the size-independent categories, such as DNS service providers or trust service providers. Being outside scope does not stop the directive reaching you through customers who are inside it.

What is the difference between GDPR and NIS2?

GDPR governs personal data: what you may collect, why you may hold it, and what rights people have over it. NIS2 governs the security and resilience of network and information systems in specific sectors, whether or not personal data is involved. One incident can engage both regimes at once, on separate reporting clocks and to separate authorities.

How long do you have to report a data breach?

Under the European model, a personal data breach is reported to the supervisory authority without undue delay and, where feasible, within seventy-two hours of becoming aware of it, and affected individuals are told without undue delay where the risk to them is high. Organisations in scope of NIS2 carry a separate obligation: an early warning within twenty-four hours, a fuller notification within seventy-two hours, and a final report within one month.

Does a small business need a data protection officer?

Under GDPR a data protection officer is required where the organisation is a public authority, where its core activities involve regular and systematic monitoring of people on a large scale, or where its core activities involve large-scale processing of special category or criminal offence data. A small business that meets none of those tests is not required to appoint one, though naming someone internally as the contact for privacy questions is worth doing regardless.

What should a small business do when a client's security questionnaire asks about NIS2?

Answer with what you do now rather than what you think the client wants to hear. The questions usually cover written security policies, incident handling and how fast you would notify them, multi-factor authentication, access control when staff join and leave, backup and recovery arrangements, and which of your own subprocessors touch their data. Gaps are common, and disclosing one with a date for closing it lands far better than an answer that does not survive the follow-up question.

Do these rules reach a business based outside the EU?

They can. GDPR reaches organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour, and other regions have their own regimes with their own triggers. NIS2 obligations follow the sectors and the member states that transpose it, but its supply chain expectations travel through contracts, which is how they reach suppliers anywhere in the world.