A modern password policy (NIST-aligned)

NIST Special Publication 800-63B is the reference most security frameworks follow for authentication. Its current revision, SP 800-63B-4, keeps moving away from complexity rules and forced changes. The reasoning is practical: when people are made to add symbols and change passwords often, they choose predictable patterns (Summer2025!, Summer2026!) that attackers guess easily.

Attackers today rarely guess passwords one by one. They reuse passwords leaked from other breaches, phish them, or spray common passwords across many accounts. A good policy addresses those threats: long, unique passwords, blocked known-bad passwords, and multi-factor authentication.

Length is what makes a password hard to crack. NIST also says systems should permit passwords of at least 64 characters and accept spaces and any printable characters, so people can use passphrases: several unrelated words, such as "copper lantern orchard tuesday". Passphrases are long and easier to remember than short complex strings.

Where a password is used together with MFA, NIST allows a shorter minimum of eight characters. In practice, most organizations set 14 or 15 characters across the board so there is one rule to remember.

Drop scheduled rotation. Instead, change a password when there is a reason: a phishing click, a breach notice from a vendor, a password found in a leak, or a staff member leaving who knew a shared credential.

NIST requires that new passwords be compared against a blocklist of commonly used, expected or compromised values. Microsoft Entra Password Protection does this for Microsoft 365 and on-premises Active Directory, with a global banned list and an optional custom list (add your firm name, city and product names). Other platforms and password managers offer breach monitoring too.

No one can remember dozens of unique 15-character passwords. A business password manager lets staff generate and store unique passwords, share credentials with colleagues without email or sticky notes, and lets the company remove access when someone leaves.

Protect the password manager account itself with the strongest MFA available, ideally a passkey or security key. Its master password is the one password worth memorizing.

• Avoid shared logins wherever the system supports individual accounts. Shared accounts make it impossible to tell who did what.
• Where sharing is unavoidable (a social media account, a vendor portal), store the credential in a shared vault folder with named members and MFA tied to a company-controlled device or number.
• Service accounts used by software should have long random passwords (or certificates), no interactive sign-in, and an owner who reviews them.
• Rotate shared credentials when anyone with access leaves.

Adapt this to your systems; keep it short enough to read in a minute.

1. 01

   Length

   Passwords must be at least 15 characters. Passphrases of several words are encouraged. Any characters, including spaces, are allowed.

2. 02

   Uniqueness

   Work passwords must not be used for any other account, work or personal.

3. 03

   Password manager

   Staff must store work credentials in the company password manager and must not save them in browsers on personal devices, in documents or on paper.

4. 04

   Changes

   Passwords are not changed on a schedule. Staff must change a password immediately if they believe it has been exposed, and IT will require a change when compromise is suspected.

5. 05

   MFA

   Multi-factor authentication is required on email, remote access, finance systems, the password manager and all admin accounts.

6. 06

   Sharing

   Passwords must never be sent by email, chat or text. Shared credentials are shared only through the password manager.