Cleaning Up an Office's Logins Twice in Ten Years, and Where the Second Bill Went Down

The received wisdom says a password cleanup is a one-time project: you pick a manager, you spend a weekend, you are done. Anyone who has actually run one, in an office or across a family, knows it is closer to a refinance. There is a cost to doing it, a cost to not doing it, and the second number grows quietly while nobody is looking. A small bookkeeping practice in the Midwest went through the exercise twice, once in the mid-2010s and once in the last two years, with largely the same four people and the same client roster. The two bills were not remotely alike.

What the first cleanup was actually buying

In the first pass, the office was solving a filing problem rather than a security problem. Credentials lived in three places: a spreadsheet on the shared drive, a tab of sticky notes around one monitor, and the memory of whichever partner had opened the account. The work was inventory. Somebody had to sit down, list every service the practice logged into, identify who held the credential, and reset the ones nobody could produce. That is slow, unbillable labor, and it is the part every estimate underprices. The software itself was almost incidental. A vault subscription for four seats cost less than a single afternoon of a partner's time.

The rules being followed then were the ones nearly every workplace had absorbed: a minimum length in the eight-to-ten range, at least one capital letter, one digit, one symbol, and a forced reset every ninety days. The practice built its whole cleanup around that. Passwords were generated to satisfy a complexity checker, then scheduled to expire. The calendar reminders were the deliverable. Everybody understood the quarter as a unit of security hygiene, and the office felt it had bought something durable. What it had actually bought was a recurring obligation, priced in interruptions, and the interest on that obligation compounded.

Where the recurring cost showed up

Forced rotation behaved the way credit behaves when the minimum payment is easy: it felt manageable each cycle and expensive in aggregate. Every ninety days, four people changed passwords they had not chosen freely, which meant they changed them predictably, incrementing a digit or swapping a season. Two of them stopped trusting the vault and kept a private fallback list, because a system that changes underneath you invites a workaround. The lockouts were the real line item. Someone would reset on a Friday, lose the new credential over the weekend, and burn an hour of a Monday recovering an account that had never been threatened by anyone.

Meanwhile the thing that would eventually cost real money was accumulating off the books. Nothing in the ninety-day regime touched reuse across services, and nothing touched the recovery email, a personal address one partner had opened years earlier and never secured. Two-factor authentication existed, and the office had switched it on for the bank, by text message, because that was the option offered. Every other login, including the portal that held client tax documents, was protected by a single factor and a rotation schedule. The practice had bought discipline where it was cheap and skipped coverage where it was expensive.

The second pass, and why the same work billed less

By the time the office rebuilt its credentials recently, the published guidance had moved. The National Institute of Standards and Technology is responsible for the federal digital identity guidelines that most corporate password policies were reverse-engineered from, and the direction of travel in that material is away from mandatory periodic expiration and composition rules, and toward length, screening against known-breached credentials, and strong second factors. That change alters the economics of a cleanup more than any product does. The expensive part of the first project, maintaining a rotation calendar and absorbing the lockouts it caused, simply stopped being work the office needed to pay for.

The inventory still had to be done, and it was still the bulk of the hours. What was different was the shape of the output. Instead of short, symbol-stuffed strings scheduled to die, each account got a long generated passphrase intended to live until something specific happened to it, a breach notice or a staff departure. Instead of one second factor on the bank, the office pushed multi-factor authentication onto email first, then the client portal, then everything that offered it, and moved off text messages to an authenticator app where the service supported the swap. Recovery methods were treated as credentials in their own right, which they are.

The one genuinely new item was the passkey. Several of the services the practice depends on now offer a login tied to the device and its biometric or PIN, with no shared secret to steal, and the office enrolled where it could while keeping a passphrase as the documented fallback. That mixed state is where most small offices will sit for a while, and it is a workable place to sit. What it ended was the argument over whether a strong password was strong enough, because on those accounts there is no longer a password sitting on a server waiting to appear in somebody else's data dump.

The deferred version of this job, priced honestly

The instinct with credential work is to put it off until something forces the issue, usually a breach notice naming a service the office uses. Paying later is the worse deal here for a reason that has nothing to do with alarm. Under pressure, the inventory step gets skipped, because there is no time to build the list, so the response covers the accounts someone happens to remember and misses the vendor portal nobody has logged into since the previous tax season. The practice then pays for the same inventory twice, once badly in an emergency and once properly afterward, plus whatever client notification and cleanup the gap produced.

Run on a normal week instead, the cost is legible and small. It is a subscription, which for a household or a four-seat office is a rounding error against one hour of professional time, plus a block of unglamorous labor to build the list and a shorter block to enroll second factors. The recurring charge that used to make this project feel like a treadmill, the quarterly reset for everyone, is gone from the current advice, which means the second cleanup ends in a way the first one never did. There is a list, it is accurate, and nothing on the calendar is scheduled to break it.

Ten years apart, the same office bought two different things under the same name. The first purchase was compliance with rules that were later withdrawn. The second was coverage: every account known, every recovery path locked, a second factor on anything that matters, and passkeys where they were offered. The hours went into the part that was always the real work.