Business password policy
Also known as: password policy, business password policy, password rules, password requirements
A business password policy defines the rules for creating and managing passwords across the organization: length, uniqueness, storage, and handling.
Modern policies favour long passphrases, unique passwords per account (via a password manager), and MFA over old habits like frequent forced changes. It's a foundational, low-cost security control.
Business password policy, explained at three levels
At home
A password policy is like the rules a building sets for its keys: how strong the locks must be, who can hold copies, and what happens when a key is lost. At work, it sets how long passwords must be, that each account gets its own, where they are stored, and when they must change. Good rules make stolen or guessed passwords much less useful to attackers.
At work
A business password policy is a written set of rules for how staff create, store and handle passwords. Modern policies require long passwords, a different one for each account, a company password manager to store them, and multi-factor authentication on important systems. Businesses care because stolen and reused passwords are among the most common ways attackers get into company accounts.
At home
Password strength comes mostly from length. Each extra character multiplies the number of guesses an attacker must try, so a four-word passphrase like 'copper lantern river sock' beats 'P@ssw0rd!'. Uniqueness matters just as much: when a website is breached, attackers try the leaked email and password on other sites, a technique called credential stuffing. A password manager makes unique passwords practical by generating and remembering them, so you only memorize one strong master password.
At work
Current guidance comes from NIST Special Publication 800-63B, whose 2025 revision says passwords used on their own should be at least 15 characters, should not require mixes of symbols and numbers, should not expire on a fixed schedule, and must be checked against lists of breached passwords. A workplace applies this through Microsoft Entra or Google Workspace settings, a business password manager such as 1Password, Bitwarden or Keeper, and MFA. Shared accounts use vault-based sharing, never spreadsheets.
At home
Old rules like forced 90-day changes and mandatory symbols backfired because people are predictable: 'Summer2025!' becomes 'Fall2025!', and cracking tools try those patterns first. Breach screening works better, because it blocks the exact passwords attackers already have. Still, any password can be phished, since you can type it into a fake site. While a good policy helps, in my view passkeys and phishing-resistant MFA are where real protection comes from, and passwords should gradually fade out.
At work
A mature policy is enforced technically rather than by memo. Identity platforms set minimum length and screen against banned password lists, as Microsoft Entra Password Protection does. A managed password vault handles shared and service credentials with access logs. Privileged accounts require phishing-resistant MFA such as FIDO2 security keys or passkeys. Rotation happens on evidence of compromise, when someone with access to shared credentials leaves, or when a service account changes owner. The roadmap should move everyday sign-ins toward passkeys.
Real-world examples
At home
Marcus's old policy forced monthly password changes, so staff just cycled through 'Password1', 'Password2', and reused them everywhere. His MSP modernized it: a password manager for unique long passwords, MFA on key accounts, and no more pointless forced changes: stronger security that staff actually followed.
At work
Nadia's firm adopted a password policy centred on a company password manager and MFA: every account gets a unique, long, manager-generated password, MFA protects important systems, and forced rotations were dropped in favour of changing only on suspected compromise, aligning with current best practice and improving both security and usability.
Common confusions
- Forcing frequent password changes improves security — Current guidance advises against routine forced changes, which tend to produce weak, predictable patterns and reuse. Change passwords when there's a reason (like a breach), and rely on uniqueness and MFA instead.
- Complex character rules matter more than length — Length generally beats complexity. A long passphrase is both stronger and easier to remember than a short string of mandated symbols, which often just yields predictable substitutions.
- A strong password policy alone keeps accounts safe — Even strong passwords can be phished or breached. MFA is the essential complement, and a password manager makes unique passwords practical. Policy works best as part of layered defence.
For analysts
Modern password policy is simpler and stronger: long unique passwords via a password manager, MFA on what matters, and no pointless forced rotations. The biggest wins come from uniqueness and MFA, and increasingly from moving toward passkeys to reduce reliance on passwords altogether.
History & origin
Early password policies emphasized complexity and frequent changes, but research and experience showed these often backfired, leading to predictable patterns and reuse. Guidance from bodies like NIST shifted toward length over complexity, discouraging forced periodic changes without cause, and emphasizing checking passwords against known breaches. Modern policy pairs these with password managers and MFA, reflecting how attackers actually compromise accounts.