Password Policy Best Practices

01What NIST changed, and why

For years, policies demanded a mix of symbols and a new password every few months. People responded predictably: Summer2025! became Autumn2025!, written on a sticky note. Attackers know those patterns well.

NIST’s digital identity guidelines now reflect that research. The current revision says verifiers shall not impose composition rules or require periodic changes, shall force a change when there is evidence of compromise, and shall reject passwords found on a blocklist of commonly used, expected or compromised values.

02The policy we recommend

• Length: at least 15 characters for any password used on its own, ideally a passphrase of several random words
• No composition rules: allow spaces and every character, without demanding symbols or capitals
• No scheduled expiry: change a password when there is evidence or suspicion of compromise
• Blocklist: reject passwords found in breach data, dictionary words and your company name
• Unique everywhere: no password shared between work and personal accounts
• MFA on every account that supports it, phishing resistant for admins
• Rate limiting and lockout to slow down guessing attacks

03Why a password manager matters

Long, unique passwords for dozens of accounts are only realistic with a password manager. It generates and fills strong passwords, stores them in an encrypted vault and lets teams share credentials without sending them by email or chat.

The vault password becomes the most important one each person has, so protect it with a strong passphrase and MFA.

04Admin and service accounts

Administrator accounts deserve stricter rules: separate admin logins that are never used for email or browsing, phishing-resistant MFA, and long, unique passwords kept in the vault. Service accounts used by software need long random passwords, the least access they require and a named owner who reviews them.

05Rolling out the new policy

1. 01

   Block bad passwords

   In Microsoft 365, Microsoft Entra Password Protection blocks common and banned passwords, including custom terms such as your company name.

2. 02

   Drop the expiry rule

   Turn off scheduled expiry once MFA is enforced and compromised sign-ins are being detected.

3. 03

   Deploy the password manager

   Start with shared accounts, then personal work accounts, and clear out passwords saved in browsers.

4. 04

   Explain the why

   Tell staff the rules got simpler on purpose: longer, unique and never reused.

06How we help

The help desk handles password resets and MFA problems for every supported user, and our Microsoft 365 administration covers MFA and conditional access. Password management is available as an add-on: an encrypted vault with a password and passphrase generator, on a platform that is SOC 2 Type 2 and ISO 27001, 27017 and 27018 certified.

See password management in the service catalog