Policy template

Password Policy template

This policy exists to define how passwords and other authentication information are created, protected and managed. It applies to all accounts on company systems, applications and cloud services.

Create this policy

What the policy contains

Creation
Protection
Systems

Who is responsible

All staff and contractors
IT Manager
Information Security Manager

What you decide

Minimum password length
Minimum length for administrator accounts
Password changesOnly when compromise is suspected · Every 90 days · Every 180 days · Every year
A password manager is provided to staff

References covered

ISO/IEC 27001 Annex A: control 5.17
ISO/IEC 27001 Annex A: control 8.5
GDPR: Art. 32 security of processing
NIS2: Art. 21(2)(j) multi-factor authentication

Other policy templates

Bring Your Own Device (BYOD) Policy
Remote Work Policy
Business Continuity Policy
Backup & Recovery Policy
Incident Management & Response Policy
Change Management Policy