Two password policy templates in line with Cyber Essentials: twelve characters or more with no forced changes, and multi-factor authentication on email and cloud services.

Effective Policy Templates

This policy template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Policy number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested policy templates. No junk, jargon or unnecessary content. Simple and usable policy templates developed over 25 years through practical use in the real world.

Further Reading

Further guidance on passwords and authentication:

• Access Control, Passwords and User Authentication
• Phishing, Email and Social Engineering
• Cybersecurity
• Information Security knowledge base

Logo Update Service

Download this policy template with your company name and logo already added!
Document Preparation is included with the alphaZ subscription.

How to Download

This file is included in the alphaZ subscription. This policy is also included in the ISO 27001 Toolkit and every alphaZ ISO toolkit that covers ISO 27001, so the toolkit route gives you this file plus everything else you need in one download.

Need Help Implementing?

If you'd like this policy prepared for your organisation along with the rest of your company policies, or help with your information security risk assessment and treatment plan, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

Password Policy Template

A password policy template setting out how passwords are managed so they are protected and secure, supplied with a second version, the Password and Secure Authentication Policy, which adds a rule for recording the issue of log-ins.

The policy has Approved By and Date Approved fields and carries a Public information classification, so it can be shared with workers, clients and other interested parties.

What the Password Policy Covers

• Sharing - passwords never shared, inside or outside the organisation
• Compromise - passwords changed immediately and the matter reported if they may have been disclosed
• Strength - at least 12 characters with no maximum length, three or more random words encouraged, and no names or personal details
• Unique passwords - a different password for each login and account
• Default passwords - changed to a strong, unique password before a device, system or account is used, and emailed reset passwords changed at first log-in
• Training - IT security training so users recognise attacks such as phishing
• Storage - not written down where they can be found, and only stored electronically in an approved password manager
• Multi-factor authentication - always used for email and other cloud services, and wherever else it is available

Two Versions Supplied

The download includes P-27 Password Policy and P-27A Password and Secure Authentication Policy. P-27A has the same rules and adds that the issue of log-ins and passwords is recorded, but the passwords themselves are never written in the record.

Checked Against Cyber Essentials

The IT policies in the range have been checked against the Cyber Essentials requirements, so their rules on passwords, devices, access and updates do not contradict what a Cyber Essentials assessment asks for.

Using the Policy

Add your company name and logo, check each commitment matches what your organisation does and edit any that do not, then approve and date the policy and share it with workers and anyone else who needs to see it.

Who Needs a Password Policy?

Organisations applying for Cyber Essentials, organisations working to ISO 27001, and any organisation whose workers log in to business systems or cloud services.

Included in the ISO 27001 Toolkit

This policy is part of the ISO 27001 Toolkit and every alphaZ ISO toolkit that covers ISO 27001.

Works with the Authentication Procedure

The PP-8-10 User Secret Authentication Policy Procedure covers authentication information, and the same rules are included as the Password and Secure Authentication Policy section of the PP-8-100 Information Security Policy Procedure.

Related Policies

• P-24 Access Control Policy - access control
• P-89 User Access Management Policy - user access management
• P-35 Information Security Awareness Policy - information security awareness
• P-114 Cyber Security Policy - cyber security