Defining Security Parameters

Password Policy

A password policy sets out the rules employees must follow when creating and managing passwords. It is one of the simplest yet most effective ways to protect a system from unauthorised access.

A password policy might include:

• Minimum length — passwords must be at least 12 characters long, since longer passwords are significantly harder to crack
• Complexity requirements — must include uppercase letters, lowercase letters, numbers and special characters (e.g. P@ssw0rd!23), preventing simple, guessable passwords
• Expiry rules — passwords must be changed every 60–90 days, limiting how long a stolen password remains useful to an attacker
• No reuse — employees cannot reuse their last five passwords, stopping people from simply cycling back to an old, familiar one
• Lockout threshold — accounts are locked after a set number of failed attempts (e.g. five), defending against brute-force attacks where software tries thousands of password combinations automatically
• No sharing — employees must never share passwords with colleagues, even managers, reducing the risk of insider threats

Without a clear password policy, employees tend to choose weak passwords and reuse them across multiple accounts — meaning a single breach can quickly compromise the entire organisation.