What Small Design Firms Get Wrong About Passwords

Shared logins, passwords on sticky notes, and no MFA are common at small design firms. This explains why it matters and what to do about it without making everyone’s life harder.

For example, let’s say someone leaves the firm on a Friday. On Monday, nobody is sure which logins they knew. The Microsoft 365 password is on a sticky note, and five people share the plan room login. Nobody wants to change them all, so nobody does.

Here is the short version. Most password trouble at small firms comes down to four habits: shared logins, written down passwords, reused passwords, and no second login step. You should fix them in this order: turn on MFA, roll out a password manager, give everyone their own login, and retire the sticky notes. The newest federal rules make this easier, not harder. Long passwords beat complex ones, and you can stop forcing a reset every 90 days.

First, credit where it is due

You have passwords on everything. You are getting the work out the door. That counts for something, and we are not here to scold anyone.

The way many firms handle passwords is built for convenience, not safety. That made sense when nobody was looking. But small firms are getting looked at now. Attackers go after small firms on purpose, because they expect the doors to be unlocked. You are a small fish, but the pond is full.

So the goal is not guilt. The goal is a setup that protects your work without slowing your team down.

You do not need to make everyone’s life harder. You need to make the firm harder to break into.

Mistake 1: Shared logins

This is the big one. One account that the whole office uses. It feels efficient. It is a real risk.

For example: five people share one login. When someone leaves the firm, that password is still in their head. Did anyone change it? Usually not. And when something bad happens on that account, you cannot tell who did what. There is no trail.

You should give every person their own login for every system. Individual accounts mean you can see who did what, and you can shut off one person without locking out the whole team. This is what we call accountability, and shared logins throw it away.

Some logins cannot be split, like a plan room, a vendor portal, or the plotter’s admin page. For those, keep the password in a shared vault inside your password manager. Only the people who need it can see it, and you change it the day someone leaves.

Mistake 2: Passwords on sticky notes (and in spreadsheets)

The sticky note is a cliché because it is everywhere. So is the shared spreadsheet of passwords, or the one in someone’s email.

The problem is obvious once you say it out loud. Anyone who walks by the desk, or opens that file, has the keys. A cleaning crew, a visitor, a hacked email account. The passwords are sitting in plain sight.

The fix is a password manager, a secure app that stores all your passwords behind one strong master password. It remembers the long, ugly passwords so your people do not have to. They learn one password. The manager handles the rest. No more sticky notes, no more spreadsheet.

Mistake 3: Reusing the same password everywhere

People reuse passwords because remembering twenty of them is impossible. That is fair. It is also how one breach becomes ten.

Here is how it goes. A website you used years ago gets hacked. Your email and password leak. Attackers take that pair and try it on everything: your Microsoft 365, your bank, your Autodesk account. If you reused the password, they are in. This is what we call credential stuffing, and it works because people reuse.

A password manager fixes this too. It makes a different long password for every site, so one leak stays one leak.

Mistake 4: No second step to log in

This is the most important fix, and the one too many firms skip. A password alone is one lock. Multifactor authentication (MFA, a second step like a code from your phone or a tap in an app) adds a second lock.

Why it matters: if someone steals or guesses your password, they still cannot get in without that second step. A stolen password alone is no longer enough. Federal cybersecurity guidance from NIST and CISA pushes MFA hard for exactly this reason.

You should turn on MFA everywhere it is offered. Your email first. Then Microsoft 365 or Google, your Autodesk account, your bank, your remote access.

Not all MFA is equal, though. Codes sent by text message are the weakest kind, and NIST treats them as a restricted option. Codes from an app are better, but a fake login page can still grab them as you type. The strongest kind is a security key or passkey (a small device or phone sign in that only works on the real website), because a fake page cannot use it. We explain that fake page trick in our post on the phishing emails targeting architecture and engineering firms.

What the password rules actually say now

The old, annoying password rules have changed, and the new ones are easier to live with. NIST, the federal agency that sets these standards, updated its guidance in 2025. Three things matter for your firm.

Length beats complexity. The old “must have a capital, a number, and a symbol” rules are out. They just pushed people to “Password1!” and a sticky note. NIST now bans those symbol rules and asks for length instead: at least 15 characters for a password used alone, or 8 if it is always paired with MFA. Think four random words, like “correct-stapler-river-cloud.” Easy to remember, hard to crack. Aim for length, not symbols.

Stop forcing resets every 90 days. NIST now says do not force routine password changes. Forced resets just make people pick weaker, predictable passwords. You only need to change a password when there is a real sign it was exposed.

Screen for known-bad passwords. Passwords should be checked against lists of common and already-leaked ones. A good password manager and a properly set up Microsoft 365 can do this for you. The takeaway is freeing: better security here actually means less hassle, not more.

One catch. These rules come as a package. Dropping the 90 day reset works because NIST also asks for real length, blocks weak passwords, and forces a change the moment a password may be exposed. Drop the resets without the rest, and you have only done the easy half.

A simple plan for your firm

You do not have to do all of this in a day. Here is the order that gives you the most safety for the least pain.

First, turn on MFA on email and Microsoft 365 or Google. That single step stops anyone who only has a stolen password. Second, get a password manager for the whole team, so everyone can use long, unique passwords without memorizing them. Third, give every person their own login and retire the shared accounts. Fourth, kill the sticky notes and the password spreadsheet.

Being proactive here is far better than reactive. A lot of attacks start with one stolen or reused password. The basics above are what keep that one bad password from becoming a one-week shutdown.

Frequently asked questions

We will lock it down without slowing you down

Good password security is not about making your team suffer through impossible rules. It is about setting things up once so the firm is hard to break into and easy to work in. MFA turned on, a password manager rolled out, shared logins retired, and the basics checked.

Our managed IT services help small architecture and engineering firms do exactly that, so your people can focus on the work, not on remembering twenty passwords. Based in East Tennessee. Serving firms nationwide. If your firm still runs on shared logins and sticky notes, give us a call for a free IT checkup. We will get the basics in place without making anyone’s day harder.

Sources: NIST SP 800-63B Digital Identity Guidelines; CISA: Secure Your Business; Phishing Resistant MFA is Key to Peace of Mind (CISA)