Password & MFA Policy

1. Purpose & Scope

This policy defines password and multi-factor authentication (MFA) requirements for all [Organization Name] accounts and systems. It applies to all employees, contractors, and third parties with access to company systems, and to all account types — individual, administrative, and service/system accounts.

2. Definitions

• Authentication Factor: Something you know (password), have (security key, authenticator app), or are (biometric), used to verify identity.
• Multi-Factor Authentication (MFA): Authentication requiring two or more independent factors.
• Privileged Account: Any account with administrative, elevated, or system-wide access rights.

3. Password Requirements

Per current NIST SP 800-63B-4 guidance, length matters more than complexity:

• Minimum 15 characters recommended; 8 characters is an absolute floor, never a target
• Maximum length of at least 64 characters must be supported — don't cap it short
• No mandatory periodic rotation. Rotate only when a specific password is known or suspected to be compromised
• No mandatory complexity rules (forced mix of character types) — length and uniqueness matter more and complexity rules often push people toward predictable patterns
• New passwords must be checked against lists of known-breached passwords and rejected if found
• Every system gets a unique password — no reuse across systems

4. Multi-Factor Authentication Requirements

SMS-based one-time codes no longer meet current authentication-assurance guidance on their own. Use an authenticator app (TOTP) or a hardware security key (FIDO2/WebAuthn) wherever available; SMS is acceptable only as a fallback, not a primary factor.

5. Password Manager & Storage Requirements

Employees must use an approved password manager rather than reusing or writing down passwords. Passwords must never be stored in plaintext, in browser-saved form on shared devices, or in unencrypted documents.

6. Privileged & Service/System Account Requirements

• Privileged accounts require MFA without exception
• Service/system account credentials are rotated immediately on any personnel change with knowledge of them
• Shared privileged credentials are discouraged; where unavoidable, access is logged and the credential is rotated after each use by a departing team member

7. Account Lockout & Monitoring

Accounts lock after [10] consecutive failed login attempts and require [IT/Security] intervention to unlock. Repeated failed-login activity is logged and reviewed for signs of credential-stuffing or brute-force activity.

8. Employee Responsibilities

• Never share your password or MFA credentials with anyone, including IT staff
• Report a suspected compromised credential immediately — see the Incident Response Plan
• Enroll in MFA on every required system before being granted access

9. Exceptions Process

Any exception to this policy (e.g., a legacy system that cannot support MFA) must be documented, approved by [IT/Security leadership], and reviewed at least annually with a plan to remediate or retire the exception.

10. Enforcement

Violations of this policy may result in disciplinary action up to and including termination of employment or contract.

11. Policy Review

This policy is reviewed at least annually and whenever NIST or an applicable framework updates its authentication guidance.