Rolling Out a Password Manager Before Year End? Where the Scope Quietly Stops

The quote usually arrives in October, because that is when the budget has to be committed and the renewal calendar has to be tidied. It has two lines on it: a per-seat annual license and an implementation fee. The person signing is an operations director, a practice manager, a finance lead. The people who will live with the result are two hundred staff who have kept the same three passwords for years and will be asked to change how they log in during the busiest weeks of the year. That gap between the signer and the user is where most of these projects go thin.

What the season genuinely changes about the work

Late in the year, three things move at once. Staffing thins out as leave is taken, so the help desk that is meant to absorb enrollment questions is running short at exactly the moment enrollment generates them. Many organizations impose a change freeze on production systems from mid-December, which means a directory integration not finished by the freeze date sits untouched until January. And seasonal hires arrive, often onboarded fast, often handed a shared login by a supervisor who has no better option. A rollout scheduled across that window either accounts for it in the plan or collides with it.

There is a second seasonal pressure that has nothing to do with security and everything to do with procurement. Fourth-quarter money expires. Vendors know this, and implementation fees quoted in October are frequently structured to be invoiced before the year turns, whether or not the work is done. A provider doing a good job will separate the license purchase, which can reasonably be booked now, from the implementation schedule, which should start when the people who need to be trained are actually at their desks. A provider doing a barely adequate one will bill the whole thing in December and start in February.

The difference between a rollout and a license purchase

A barely adequate job looks like this: seats are provisioned, a welcome email goes out with a link and a short video, an admin console is handed to whoever asked for it, and the engagement closes. Nothing in that is wrong. It is simply not an implementation, and six months later the honest number is that a third of staff logged in once and went back to the browser autofill they already trusted. The license is being paid for in full and used in part, which is the most common failure in this category and the least visible on any report.

A good job is recognizable by what it touches outside the product. Directory integration, so accounts are created and, more importantly, removed when someone leaves. An inventory of shared credentials, the service accounts and the front desk logins and the social media password four people know, moved into managed vaults with named owners. A documented recovery path, including the break-glass procedure for when the administrator who holds the keys is unreachable. Enrollment sessions run live, in groups, by department, with the awkward accounts handled in the room rather than deferred to a ticket.

There is also a policy document that has to change, and this is where the advice itself has moved. The National Institute of Standards and Technology is responsible for the federal digital identity guidance that most corporate password policy was originally copied from, and that guidance now leans on length, on screening credentials against known breached lists, and on not forcing scheduled rotation in the absence of evidence of compromise. A good provider rewrites your handbook language to match what the tool now enforces. A thin one sells you the vault and leaves the mandatory quarterly change sitting in the employee manual, contradicting it.

Fixed price, day rate, cost plus, and who eats the overrun

Fixed price moves the risk of an overrun to the provider, which is why the scope definition becomes the entire negotiation. Watch what a seat means: is a seasonal worker with a six-week contract a seat, and are you billed on headcount or on active accounts at the true-up date? Watch what counts as a migration item, because importing two thousand browser-stored passwords is trivial and untangling forty shared service accounts is not. Fixed price is right for the parts that are genuinely known, and a provider quoting fixed price on discovery work is either padding heavily or planning to argue about change orders in January.

A day rate puts the overrun risk on you, and that is not automatically a bad trade. When nobody can say how many shared logins exist inside a legacy line-of-business system, a fixed price for that work is a guess with your money on it either way. The workable structure is a capped day rate for discovery, a written output from that phase, and then a fixed price for the migration once the scope is actually known. Cost plus, where you pay documented cost plus an agreed margin, shows up mainly on long engagements with larger providers and is only honest when the cost documentation is open to you.

What to write down before the signature

Define done as a percentage of staff enrolled and active at a named date, not as licenses issued. Name the individual, on their side and on yours, who holds recovery authority, and write down what happens when that person leaves. Establish in the contract that your vault data can be exported in a readable, standard format at termination, because the cost of leaving is a real number and it should be known before you are trying to leave. Get the renewal price for year two and year three in writing now, alongside the seat true-up mechanism.

One more item belongs in the document: who updates the policy language, and by when. It is a small deliverable that costs a provider almost nothing and is skipped almost universally, and it is the piece that keeps your written rules from contradicting your new system in front of an auditor.

Set a review for the first week of March. The number to look at is not the invoice, which will have been paid, but the count of accounts that have logged in during the previous thirty days, department by department, against the count you were sold.