Password Policy
What is Password Policy?
A set of rules designed to enhance computer security by encouraging users to create strong passwords and manage them properly. Password policies define minimum length, complexity, rotation frequency, and history requirements.
Terms that appear alongside password policy
Each of these is named in at least one of the same controls as password policy. The number is how many controls name both.
- policy 9 shared controls
- authentication 5 shared controls
- multi factor authentication 4 shared controls
- least privilege 2 shared controls
- privileged access management 2 shared controls
- remote access 2 shared controls
- access management 2 shared controls
Frameworks that govern password policy
What the standards actually require on password policy
Requirements naming password policy across 6 standards, quoted from the control text.
When drafting password policies, agencies should consider including a requirement for passwords to be changed annually.
new-zealand-information-security-manual-nzism::16.1.31.C.07 · 16.1.31.C.07 Consider annual password changes in password policy →Enforce a password policy that requires sufficient length, complexity, history, and rotation, and apply it consistently across all accounts that touch SWIFT components.
CSCF-4.1 · Password Policy →Keep an approved password policy that sets strength requirements, implement it in the systems it governs, and review it at least annually.
CCM-IAM-02 · Strong Password Policy and Procedures →Authentication must be protected against brute force, including minimum password length, password deny lists or use of MFA and lockout or throttling.
CEP-UA-03 · Password Policy and Brute Force Protection →Protect credentials, especially highly privileged accounts: implement multi-factor authentication where possible, reduce privileges to least necessary, enforce secure password policy (length over complexity), ensure unique credentials for all accounts includin...
CISA-ICS-7S-5 · Manage Authentication →Recommended settings and defaults for the security capabilities so they are implemented per E26 and integrator specifications (accounts, authorisation, password policy, safe machinery state, firewall rules), serving as the basis for verifying item 29.
iacs-unified-requirements-e26e27-cyber-resilience-of-ships-and-on-board-systems::E27-3.1.5 · E27 3.1.5 Security configuration guidelines →Questions people ask about password policy
What is Password Policy?
Why is Password Policy important for compliance?
Which compliance frameworks address Password Policy?
Where can I learn more about Password Policy?
See how Password Policy applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.