Password policy

What it means

A password policy is a set of internal rules on how long and complex passwords must be, where they are stored, when they change and which systems require two-factor authentication. It forms part of the company's security policy and applies to employees and external contractors alike.

Modern guidance differs sharply from the old. Instead of short passwords with special characters changed every month, it favours long passphrases, a unique password for every account and a password manager. Forced changes are required mainly when a leak is suspected, not on a calendar basis.

A password is only one layer of protection. Most accounts today are compromised through phishing or through reuse of a password leaked from another service. A password policy therefore makes sense only together with two-factor authentication, training and access control.

How it works in practice

A sensible policy for a small firm might include a minimum length of around 12 to 14 characters, a ban on reuse, a mandatory password manager, two-factor authentication for email, the accounting system, banking and remote access, and screening passwords against lists of known breached passwords.

Shared accounts, for example for social networks or supplier portals, are kept in a shared vault in the password manager, not in a spreadsheet or email. When an employee leaves, shared account passwords are changed and access is removed the same day.

Administrators' privileged accounts follow stricter rules under privileged access management. For companies covered by NIS2, a documented password and authentication policy is one of the expected measures, and the supervisor may ask to see it.

What to watch out for

Overly strict, impractical rules backfire: people write passwords on sticky notes, just append the month number or use the same password everywhere. The rules must be understandable and backed by tools that make compliance easy.

Default passwords on devices such as routers, printers or camera systems are often never changed. They are a favourite way in for attackers, so the policy must cover them explicitly and they should be the first thing changed when a new device is installed.