Make explicit distinction on defining what passwords are personal and what are business/work related and separate those two types in the primary stage to help/ease applying strict policy on those business/work related ones and secure them easily next to defining password…
