NIST Is Right. It's Also Not Built for You.

The standard advice goes something like this:

Use a unique, randomly generated password for every account. Enable MFA everywhere. Never reuse anything. Treat every login like it's protecting your life savings.

This advice is technically correct.

It is also, for most people, a fast path to giving up entirely.

Security burnout is real. When the guidance is so demanding that following it perfectly feels impossible, people don't follow it at all. They reuse one password everywhere, skip MFA because it's annoying, and cross their fingers. That outcome is far worse than the one the guidance was trying to prevent.

The problem isn't that the advice is wrong. The problem is that it was written for organizations managing thousands of accounts across enterprise infrastructure, not for a person trying to protect their email and their Netflix login with the same amount of mental energy.

There's a better way to think about this.

Not all accounts are equal. The risk of losing access to your Reddit account isn't the same as the risk of losing access to your bank. Treating them identically doesn't make you more secure. It makes you exhausted.

Think of it like a property you own. Your house is where you live. Your identity, your valuables, everything that would be genuinely devastating to lose. Your basement is still yours, still matters, but it's less visible day to day. Your shed out back holds things you'd miss if they were gone, but losing it wouldn't upend your life.

Your digital accounts work the same way.

Here's a framework that reflects how risk actually works.

This is who you are online. Compromise here is genuinely serious and potentially very difficult to recover from.

What belongs here:

The standard here is non-negotiable:

The reason this tier gets the full treatment isn't paranoia. It's because a breach here cascades. Someone in your email can reset every other password you have. Someone in your Google account has your contacts, your photos, your location history, and potentially your payment information. The blast radius is enormous.

This is also the tier where the "use a password manager" advice actually makes sense, because the complexity is real and the stakes justify the setup cost.

This tier is less obvious, which is part of what makes it worth thinking about carefully.

What belongs here:

The risk here isn't always direct. It's aggregation. A single social media account might not feel sensitive. But your Facebook profile, combined with your LinkedIn, combined with your Amazon order history, combined with your healthcare portal, tells a very complete story about who you are, where you live, what you own, and what your life looks like.

Attackers know this. Data brokers know this. The value of Tier 2 accounts isn't always what's in them. It's what they reveal when combined.

The standard here:

You don't have to be as rigorous here as Tier 1. But you do have to be thoughtful.

This is where the standard guidance quietly falls apart for most people, and where a little honesty goes a long way.

What belongs here:

Here's the thing NIST won't tell you: shared passwords in Tier 3 are fine.

Not shared with Tier 1. Not shared with Tier 2. But a password you use across a handful of low-stakes accounts where you've posted nothing personal and saved no payment information? That's a reasonable tradeoff. The risk is low. The recovery cost if something goes wrong is low. And preserving your mental energy for the tiers that actually matter is a legitimate security strategy.

The goal isn't perfect hygiene everywhere. The goal is protecting what actually needs protecting, without burning out in the process.

The conventional guidance optimizes for a world where every account is equally valuable and every person has unlimited patience for security friction. Neither of those things is true.

The tiered model works because it matches the level of effort to the level of actual risk. It gives you a clear answer to the question "how careful do I need to be about this?" without requiring you to apply maximum effort to everything.

It also makes the non-negotiables easier to hold. When you're not exhausted from treating your Reddit login like a nuclear launch code, you have more capacity to actually protect your email and your bank.

That's not a compromise. That's good security thinking.

The tiers aren't permanent. An account can move.

If you add a saved payment method to a site that used to be Tier 3, it moves up. If you start using a work email for sensitive communications, it moves up. The framework is a way of thinking, not a fixed classification system.

Review it occasionally. Adjust as your digital life changes. And if you're not sure where something belongs, err toward the higher tier until you've thought it through.

If you want to print this out or save it somewhere, here's the whole framework on one page.