Somewhere in your organization there is probably a spreadsheet called "Logins." It is shared with more people than anyone remembers, it is not encrypted, and it was last updated before the last person left. A password file is among the first things an attacker looks for after getting into any single mailbox or laptop, and since nobody trusts the file enough to keep it current, it cannot even do its stated job of recording what exists.
The replacement is a password manager: an encrypted vault that stores credentials, generates strong unique passwords, and controls who can see what. It is the foundation that every other security habit this month stands on, because unique passwords are what make a stolen one a one-door key. This quick win gets the vault open and three logins inside it in twenty minutes. The full migration happens over the coming weeks; today is for starting.
Do this
Pick a vault. Bitwarden and 1Password are the widely used hosted options, both with organizational plans; KeePassXC is a free local vault for organizations that prefer a file they control. Do not spend the twenty minutes comparing; any of them beats the spreadsheet.
Create the account in the organization's name, using a role-based email address the organization controls, not your personal email.
Choose the master passphrase: four or five random common words, long rather than complicated. Share it with no system and no colleague.
Turn on two-factor authentication (2FA) for the vault itself, and write the vault's recovery kit on paper. Put the paper in the office safe or a bank deposit box; this is the one credential whose backup belongs offline.
Install the browser extension and move your three most important logins in: the domain registrar, the hosting account, and the organization's main email. Let the vault generate a fresh password for each if the old one was weak or reused.
Create one shared collection and add a second administrator. Never exactly one.
Done looks like a vault in the organization's name with 2FA on, a paper recovery kit somewhere physical, three critical logins inside with fresh passwords, and a second person who can get in.
What to expect
The first three logins take the longest. After that, every login you confirm during the inventory moves into the vault as you find it, and the row gets marked migrated. When the last row is done, delete the spreadsheet and empty the trash. Expect one colleague to resist on principle; a twenty-minute sit-down with autofill doing the persuading converts more people than any memo.
One quick win every Saturday. Get the next one, plus the weekly Web Managers letter and every worksheet from the book and the podcast, with a free account. The Tool Decision Tree from Chapter 2, for choosing between vaults, is in the Web Account Inventory Workbook inside the portal.