I think it starts with support/backing from stakeholders, perhaps the founders or someone in a position to dictate/enforce policy. Once the stakeholders are on board, then I think the next step is to decide if you want to implement a physical solution (aka Folder/Binder) or a digital solution (aka Software, or a Software related Process), or perhaps a combination of both. Each organization will be different, so the best choice(s) would likely depend on facilitating existing policy/process or existing practices/culture. For example, if there are remote workers, then a physical solution (aka Folder/Binder) might be a bad idea. Another example, if IT security is an afterthought, or the IT Infrastructure is not controlled/managed then a digital solution (aka Software based) might be a bad idea. It all depends on the situation/organization, so this will be a call that you need to make. In terms of managing the passwords, I would recommend a role based distribution on a need to know basis. In other words, if there is no reason for all the employees to know all the passwords, then do not give them all the passwords. Just give them the passwords they need to perform their job functions, and secure the passwords that they do not need elsewhere. Sometimes (especially in a startup or when the workforce is small), the lines between roles can be blurred, so your mileage may vary. But the general rule of thumb is the same; only give out what you need to give out at a minimum. I would also recommend setting and enforcing password policy. From my experience, the standard is 16+ characters, one upper, one lower, one special, one number, no words, no re-using, and it must be changed every 60-90 days. Many IT Systems allow you to set and enforce this via policy, for example in a Windows Environment you can set/enforce password policy via Active Directory. Another example, in a Unix/Linux Environment, you can use chage / passwd (or modify the shadow file directly, not recommended) and PAM. I would also recommend to audit frequently. I think the most important aspect of creating/enforcing policy is to let everyone know that it's nothing personal. Properly implemented security practices can be a pain in the ass. But effective Security is essential to protecting your assets. Getting the workforce on board is key. In most scenarios, your weakest point is internal (weather it is realized/intentional or not).