I'm part of a small group of people who manage a website and the server it runs on. We have many accounts with third-party websites or services that multiple people on the team need to access. What is the best practice password policy to use in this situation? The policy needs to accommodate many accounts on other sites (say, more than a dozen), as well as how the passwords are shared among team members (and changed if members leave).
Edit: To response to this.josh's comment, as I mentioned, more than 10 third-party accounts. Most of the accounts are standard password-protected accounts where there must be one for the whole team (these are services associated with the website as a whole, like the Amazon Affiliates program or reCAPTCHA). The services provided vary, few are critical, but they are still important to protect.