In October the Saturday quick wins put a password manager in place and ran your organization's addresses through Have I Been Pwned. Those two tasks built the tools. This Monday's twenty minutes uses them, and it answers a question the vault alone cannot: how many of your organization's passwords are doing double duty? A password reused across two services is a skeleton key waiting for either service to leak it, and the leaks happen on the vendor's schedule, never yours.
The security baseline in Chapter 8 of the book has one line about credentials, and it is easy to read past: every account gets a unique, vault-generated password, and nothing is reused. Most organizations believe they meet that standard. The audit below is how you find out, and it takes less time than the meeting you will be in afterward.
Open the health report
Every modern password manager includes a report that scores the vault for you. Bitwarden calls them vault health reports; 1Password calls it Watchtower. Whatever the name, the report groups the vault's entries into three lists: passwords used in more than one entry, passwords too short or too predictable to count as strong, and passwords that have appeared in a known breach. Open it and write down the three counts with today's date. Those numbers are the before picture, and the same report next quarter is the after.
Rotate in damage order
Reused passwords come first, because one leak anywhere exposes every account in the group. Work the list in the order the October two-factor post used: the organization's email, which resets everything else; then hosting, the registrar, and the DNS provider; then the social accounts; then anything that touches money; then the rest. For each one, let the vault generate a new password, save it, and let the health report shrink as you go.
Exposed passwords come next, with the same order. A password in a breach list is already in the hands of the automated guessers, whether or not the account that leaked it mattered.
Weak passwords are the third pass, and the honest advice is to let the first two passes take the morning and schedule the third for next Monday if it runs long. A weak password behind two-factor authentication (2FA) is a lesser risk than a reused one without it.
Count what the vault does not know
While rotating, you will remember accounts that never made it into the vault: the old newsletter tool, the printer vendor's portal, the stock photo site. Write each one down as it surfaces. Every account recovered this way gets a vault entry, a fresh password, and a row in the Chapter 2 inventory, with the person responsible named beside it. This is how the vault finishes growing, and it is why the audit belongs on the calendar rather than in a single heroic afternoon.
Check the 2FA column
Finish by confirming the second factor is on for every account in the damage-order list and that the backup codes live in the vault entry, not on one person's phone. The vault's report may flag accounts that offer 2FA without it enabled; treat each flag as a line item.
Done looks like a dated note with the three starting counts, every reused and exposed password rotated in order, the newly discovered accounts added to the vault and the inventory, and the 2FA column confirmed. If the reused count started high, record that honestly. The finding is not a failure; it is the reason the quarterly audit exists.
Get the playbook for the day a notice arrives. The audit above is the preventive half; the "Your Password Is in a Breach" playbook is the emergency half, with blanks for the service, the affected addresses, and every rotation. It is part of the Web Emergency Playbook, and the sampler is free. Tomorrow's post walks that playbook step by step.