The Saturday Security Sweep: A Realistic Password Drill for Small UK Teams
Photo: Alan Reid , CC BY-SA 2.0, via Wikimedia Commons
The phrase password hygiene usually arrives with a corporate slide and a mandatory training module. For a five-person studio, a family-run ecommerce outfit or a small professional services firm, that is not how the tools actually get used. People share a Canva login. The office manager holds the domain registrar. Someone’s personal phone number is the recovery route for the company Instagram. A weekend drill is not about becoming a security department; it is about closing the obvious gaps while the kettle is on.
Friday: pick the scope and warn people
Do not try to fix every account in one go. Pick the accounts that would cause real disruption if they were lost or hijacked: email, banking, payroll, domain registrar, website hosting, cloud storage, social media, and any tool that holds client data. Tell the team what is happening and why. A short message is enough: we are spending Saturday morning tightening access, expect a few prompts, do not approve anything unexpected.
Appoint one organiser. In a small team this is often the person who already knows where the passwords live. Give them a temporary password manager vault and a shared checklist. The aim is to leave a record, not to create a second shadow IT problem.
Saturday morning: inventory the real accounts
Start with a shared document or a password manager item list. For each account, record the service, the business owner, the login email, whether it is shared, whether multi-factor authentication is on, and where the recovery route points. Do not store the passwords in the document. Store them in the password manager.
Pay special attention to shared accounts. A generic info@ inbox is fine if it is a mailbox with named users behind it. A shared social media login passed around in a WhatsApp message is not. Where possible, move to named users with role-based access. If a tool forces a shared login, put it in the password manager, turn on MFA, and make sure the recovery email is a monitored business inbox rather than someone’s personal address.
Saturday afternoon: MFA and passkeys where they fit
Multi-factor authentication is still the highest-value fix for most small teams. Start with email, banking, domain registrar, cloud storage and any admin console. Use authenticator apps or hardware keys rather than SMS where you can. SMS is better than nothing, but SIM-swap and number-recycling risks make it a weaker default.
Passkeys are increasingly practical for services that support them. They can reduce phishing risk and remove some password reuse, but they need a recovery plan. Do not roll them out to the whole team in one afternoon without testing on one or two accounts first. Keep backup codes somewhere sensible, not in a screenshot on the shared drive.
Sunday morning: recovery routes and shared access
Recovery is where small teams are most exposed. For each critical account, ask: which email receives the reset link, which phone number receives the code, and who can access those? If the answer is a former employee’s phone or an inbox nobody checks, fix it. Make sure at least two trusted people can recover the domain registrar and the main email admin account.
Review shared access too. Remove anyone who has left, including contractors and old agencies. Check social media roles, website admin, accounting tools and any app with client data. If a tool supports guest access, use it instead of handing over a master login.
Sunday afternoon: test, document and prepare the paper trail
Run a short test. Can the organiser sign in with MFA? Can a second person recover the main email account? Are backup codes stored securely? Can the team find the password manager emergency kit? Write a one-page record: what changed, who owns each critical account, and what is still outstanding.
This record is also useful for cyber insurance. Insurers increasingly ask for evidence of MFA, backups, access control and an incident response plan. You do not need a formal certification for a small team, but you do need evidence that you have thought about it. Keep the checklist, the date and the names of the people who did the work.
ICO reporting basics
If something goes wrong, do not improvise. The ICO expects organisations to report certain personal data breaches within 72 hours of becoming aware of them, where the breach is likely to result in a risk to people’s rights and freedoms. Keep a simple incident log, note what happened, who was affected and what you did. If you are unsure whether to report, check the ICO guidance and document your decision. A weekend drill is a good time to bookmark the reporting page and write down who would make the call.
The realistic finish line
You will not finish everything. That is fine. The point of the Saturday security sweep is to move the team from informal habits to a documented baseline: named users where possible, MFA on the accounts that matter, recovery routes that do not depend on one person’s mobile, and a record you can show an insurer or a client. Do it once, then put a reminder in the calendar for a lighter quarterly check. The goal is not a fortress. It is fewer obvious doors left open.
