Most password policies still enforce 90-day rotation and complexity rules that current NIST guidance explicitly advises against, because they push people toward predictable patterns. This one follows the evidence: length, breach screening, and MFA.
Set a long minimum and drop composition rules. Require at least 12 characters for standard accounts and more for privileged ones, and stop mandating a symbol and a number. Composition rules reliably produce Password1! rather than genuine entropy.
Screen against breached password lists. This replaces forced rotation as the control that actually matters. Checking new passwords against known-compromised lists blocks credential stuffing far more effectively than expiry ever did.
Rotate on evidence, not on schedule. Force a change when there is indication of compromise. Scheduled rotation produces incremental passwords and more helpdesk tickets without measurable security benefit.
Here's a preview. Unlock the free download to get all 3 sections (2 more below).
| Account type | Minimum length | Composition rules | Rotation | MFA | Storage |
|---|---|---|---|---|---|
| Standard user | 12 characters | None (length over complexity) | On evidence of compromise only | Required (app-based or better) | Password manager |
| Privileged / admin | 16 characters | None | On evidence, and on role change | Required (phishing-resistant) | Privileged vault |
More free templates IT teams use alongside this one.
Access control policies state least privilege and then leave the mechanics unspecified, which is where it breaks down. This one fixes the approval route, the review cadence, and the privileged-access rules explicitly.
MFA rollouts stall at about 90% coverage, and the remaining 10% is where the risk concentrates: shared accounts, service accounts, field staff without smartphones, and executives who asked for an exemption.
The information security policy is the parent document auditors ask for first. Its job is not to contain every control. It is to state the organisation's position, assign responsibility, and point to the specific policies that implement it.
Current NIST guidance advises against arbitrary scheduled expiry, because it leads users toward predictable incremental changes. Force a change when there is evidence of compromise instead, and rely on breach screening and MFA for ongoing protection.
At least 12 characters for standard accounts and 16 or more for privileged ones, with composition rules removed. Length contributes far more to resistance than requiring a symbol, which mostly produces predictable substitutions.
Checking a chosen password against lists of credentials exposed in known breaches and rejecting matches. It is the single most effective password control available, because credential stuffing with previously breached passwords is the dominant attack.
