Digital Hygiene: Useful Account Habits for Families

Change exposed passwords, not passwords by calendar alone

NIST’s digital identity guidance says services should not require arbitrary periodic password changes. Change an exposed, reused or otherwise compromised password promptly; follow a legitimate provider’s recovery process when compromise is suspected.

Sources: NIST: Digital Identity Guidelines: Authentication

Choose a manageable routine

Review settings with permission and use current provider instructions. A family checklist is not a substitute for a specific security alert.

1. Use unique passwords and a password manager you can recover safely.
2. Enable a supported stronger MFA method; keep recovery codes private.
3. Install supported updates and remove access for apps you no longer use.
4. Check recovery details and unfamiliar sessions from the official account.

Sources: NIST: Digital Identity Guidelines: Authentication; CISA: Implementing phishing-resistant MFA

Make suspicious requests part of the routine

Practice checking an unexpected message through a known channel. If someone approved an unfamiliar sign-in prompt, follow account-recovery steps rather than merely changing a device passcode.

Sources: FTC: How to recognize and avoid phishing scams; FTC: How to recover your hacked email or social media account