A password and MFA policy that matches how attackers actually get in
Most small-business password policies are copied from a 2010 corporate template: eight characters, a symbol, change every 90 days. Every one of those rules is now wrong. Here is what to require instead, with the policy text you can paste.
Attackers rarely guess passwords any more. They buy them from previous breaches, phish them with a fake login page, or push MFA prompts until someone taps approve. A policy is only useful if it addresses those three, which is why NIST's current guidance dropped complexity rules and forced rotation and instead emphasises length, uniqueness, and multi-factor authentication.
What to require
- Length over complexity. Minimum 14 characters. A passphrase of three or four unrelated words is stronger and easier to remember than "P@ssw0rd1!". Do not require symbols or numbers; they push people toward predictable substitutions.
- Unique per account. The most common way a company gets breached is one reused password showing up in a leak. Reuse between personal and work accounts is prohibited.
- No forced rotation. Change a password when there's reason to think it's exposed, not on a calendar. Scheduled changes produce "Summer2026!" followed by "Autumn2026!".
- Password manager mandatory. Name the approved one. It's the only realistic way to get unique 14-character passwords across 40 services, and shared vaults solve the "team social media login" problem without emailing credentials.
- MFA required on: email, the password manager, remote access, cloud admin consoles, banking and payments, and anything holding customer or employee data. Authenticator app with number matching preferred; SMS only where nothing else exists.
- The MFA-fatigue rule. Never approve a prompt you didn't trigger; deny it and report it, because an unexpected prompt means the password is already compromised.
- Admin accounts separate, always MFA, never used for email or browsing. Default passwords on new devices changed before they touch the network.
Policy text you can use
- Passwords must be at least 14 characters. A passphrase of three or more unrelated words is recommended.
- Every account must have a unique password. Reusing a password across two or more services, including between personal and work accounts, is prohibited.
- Passwords do not expire on a fixed schedule. They must be changed immediately if there is any suspicion they have been exposed, or when the IT Lead directs.
- All work passwords must be stored in the approved password manager, [Password Manager Name], which must also be used to generate new passwords. Passwords must not be stored in browsers on shared devices, spreadsheets, notes apps, on paper, or in email.
- MFA is mandatory on email, the password manager, remote access, cloud administration consoles, banking and payment platforms, and any system holding customer or employee data.
- Users must never approve an MFA prompt they did not initiate. Unexpected prompts must be denied and reported to the IT Lead immediately.
- Administrator accounts must have a separate password from the user's day-to-day account and must always be protected by MFA.
Add a Purpose, Scope, Responsibilities and Enforcement section around it, have the owner sign it, and collect acknowledgements. That's the whole policy; anything longer will not be read.
How to enforce it without policing
Enforce technically where you can: tenant-wide MFA in Microsoft 365 or Google Workspace, minimum password length in the directory, and the password manager's own reports on weak or reused entries. The policy then exists to make those settings legitimate and to cover the systems you can't configure centrally.