Another security best practice to be mindful of — a password alone should never be the only authentication mechanism for critical data, sensitive systems, and potentially daily operations into those resources. Multi-factor authentication (MFA) or two-factor authentication (2FA) should be layered on top to ensure a unique password, per account, is actually being used by the correct identity when authentication is required.