# What federal small business security guides say about accounts

NIST and CISA guides for small businesses ask for access by job need, MFA, unique passwords, and removing access when people leave. One adds a login per person.

Updated: October 16, 2026

Three free federal guides for small businesses cover accounts: NIST IR 7621 Rev. 1, NIST SP 1300 and CISA's Cyber Essentials. They agree on most basics. Limit access to what each job needs, and use multi-factor authentication (MFA), a second check beyond the password. Use unique passwords, and remove access when people leave. NIST IR 7621 also asks for a separate login for each person. Only IR 7621 sets a password-change schedule, every 3 months, and NIST's newer SP 800-63B-4 drops periodic changes.

## The three guides

NIST IR 7621 Rev. 1, Small Business Information Security: The Fundamentals, came out in November 2016. It runs 54 pages and includes sample policies.

NIST SP 1300, the Cybersecurity Framework 2.0 Small Business Quick-Start Guide, came out in February 2024. It groups actions under the framework's six functions: Govern, Identify, Protect, Detect, Respond and Recover. Each action carries a framework code, such as PR.AA-05.

CISA's Cyber Essentials is written for leaders of small businesses and of small and local government agencies. It has six "essential elements," and the one called Your Surroundings covers who can get into your digital workplace.

None of the three is a regulation. SP 1300 describes the framework behind it as voluntary guidance for organizations of any size, sector or maturity.

## What each guide asks for

| Practice | NIST IR 7621 Rev. 1 | NIST SP 1300 | CISA Cyber Essentials |
| --- | --- | --- | --- |
| A separate login for each person | Yes, including contractors who need access | Not listed | Not listed |
| Access limited to job need | Yes; no one employee should reach all systems | Yes (PR.AA-05) | Yes, on need-to-know and least privilege |
| Administrator rights kept apart | Everyday work in accounts without admin rights | Not listed | Admin permissions on least privilege |
| Multi-factor authentication | For systems with important information | On all accounts that offer it, starting with those that reach the most sensitive information (PR.AA-03) | For all users, starting with admin and remote users |
| Default passwords changed | Yes, on install and regularly after | Yes (PR.AA-01) | Not listed |
| Strong, unique passwords | A strong, unique password for each account | Consider a password manager to create them (PR.AA-03) | Unique passwords for all user accounts |
| Access removed when people leave | Delete their accounts and change group passwords they knew | Asks whether you remove access people no longer need | Policies for transfers and terminations |
| A list of accounts and vendors | A list of accounts and their privileges | An asset inventory | Inventories of connections such as user accounts, vendors and partners |

## Where the guides differ: changing passwords

NIST IR 7621 says passwords should be changed at least every 3 months. Its reason is that passwords left alone give attackers time to crack them, and may spread among coworkers.

NIST's own identity guidance has since moved the other way. SP 800-63B-4, finalized in July 2025, says password systems "SHALL NOT require subscribers to change passwords periodically." They must force a change when there is evidence that a password has been compromised. SP 1300 doesn't set a schedule; it points to password managers and MFA instead. For more on the 90-day rule, see [Do passwords still need to be changed every 90 days?](/guides/shared-accounts/periodic-password-change)

## What the guides say about shared logins

IR 7621 gives the reason for separate accounts in plain terms. Without an account for each user, it says, investigating data loss or unauthorized changes may be difficult. A shared login leaves one name in the log for everyone who used it.

The same guide also accepts that some passwords are shared. Its offboarding step tells you to delete the person's username and account from all systems, and to change any group passwords they knew. That second step is the cost of a shared login. Each departure means a new password for everyone who still uses it.

## A checklist for the person who handles IT

This list follows the table. Each item names the guide that backs it.

1. List every account your business uses, who uses it, and whether it has admin rights (IR 7621; Cyber Essentials).
2. For each account, check that access matches the person's job (SP 1300 PR.AA-05).
3. Turn on MFA, starting with banking, email and admin accounts (SP 1300; Cyber Essentials).
4. Change every default password on devices and software (IR 7621; SP 1300 PR.AA-01).
5. Mark which logins more than one person uses. Note who knows each password, so you know what to change when someone leaves (IR 7621).
6. Write down the steps for removing access when people transfer or leave (Cyber Essentials).

For a fuller offboarding list, see [Account checklist for onboarding and offboarding employees](/guides/hr-access/onboarding-offboarding-checklist).


## Frequently asked questions

**Are these guides required by law?**

No. They're guidance, not regulations. SP 1300 describes the NIST Cybersecurity Framework as voluntary guidance for organizations of any size, sector or maturity.

**Do the guides allow shared accounts?**

None of them bans shared accounts outright. NIST IR 7621 asks for a separate account for each user, including contractors, and its offboarding steps mention changing group passwords the person knew.

**Should we change passwords every 90 days?**

NIST IR 7621 from 2016 says every 3 months. NIST's newer SP 800-63B-4 says password systems shall not require periodic changes, only a change when there's evidence of compromise.

**Where should we start with MFA?**

SP 1300 says to start with accounts that reach your most sensitive information. Its checklist names banking, accounting and tax, merchant, email, password manager and website accounts.

## Sources

- [NIST IR 7621 Rev. 1, Small Business Information Security: The Fundamentals (November 2016)](https://nvlpubs.nist.gov/nistpubs/ir/2016/NIST.IR.7621r1.pdf)
- [NIST SP 1300, NIST Cybersecurity Framework 2.0: Small Business Quick-Start Guide (February 2024)](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.1300.pdf)
- [CISA: Cyber Essentials](https://www.cisa.gov/resources-tools/resources/cyber-essentials)
- [NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (July 2025)](https://csrc.nist.gov/pubs/sp/800/63/b/4/final)
- [NIST SP 800-63B-4, Section 3.1.1.2, Password verifiers (online edition)](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/)

## How Junify handles this

**Doing this by hand** You map each requirement to how your team actually works. You keep a record an auditor can review: which accounts exist, who may use each one, and who used it. And you reread the rules each time they change.

**With Junify** For logins that stay shared, Junify covers three of these practices: knowing who used them, removing access when someone leaves, and keeping the password out of people's hands. People verify on their own phone before opening the account, so each use is recorded by person. Change the password at setup so only Junify holds it. When someone leaves, remove their access, and the rest of the team keeps working without a new password.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&from=guide&cluster=compliance&slug=small-business-cybersecurity-guidance-accounts)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)

## More on this topic

- [What access logs need to show when you decide whether to report a breach](/guides/compliance/breach-notification-access-logs): Logs show whether data was viewed, by whom, for how many people and since when. HIPAA presumes a breach unless you can show a low probability of compromise.
- [Password sharing and the federal anti-hacking law (CFAA)](/guides/compliance/cfaa-password-sharing): The CFAA turns on whether the system's owner allowed the access. In Nosal, former employees using a current employee's login acted without authorization.
- [What CIS Controls 5 and 6 (v8.1) ask of your accounts](/guides/compliance/cis-controls-account-access-management): Control 5 asks for an account inventory, disabled dormant accounts and separate admin accounts. Control 6 covers granting and revoking access, and MFA.