Cyber Security
Modern password policy: what NIST recommends for companies today
Complex rules and 90-day changes lead to weak, predictable passwords. Here is what current NIST guidance recommends and how to put it into practice in your company.
Q-entra editorial teamPublished on 6 min read
Contents
Key takeaways
- Length matters more than complexity: current NIST guidance requires at least 15 characters for passwords used on their own and rules out mandatory character types.
- Passwords are changed only when there is an indication of compromise, not on a fixed schedule.
- New passwords are screened against lists of common, expected and breached passwords.
- Password managers and autofill must work, and pasting should be allowed. A company password manager is what makes unique passwords realistic.
- MFA, separate admin accounts and documented service accounts complete the policy.
What a modern password policy looks like
Many company policies still follow rules from the early 2000s: at least eight characters, upper and lower case, a digit, a special character and a new password every 90 days. These rules feel strict, but in practice they lead to predictable passwords such as a season followed by the year, to notes under the keyboard and to frustrated employees.
The US National Institute of Standards and Technology (NIST) sets out its recommendations in guideline SP 800-63B, whose current revision was published in 2025. Written for US federal agencies, it serves many organisations worldwide as a reference. The core messages: length instead of complexity, no changes without a reason, screening against known passwords, support for password managers and an additional factor for important access.
Length beats complexity
The longer a password, the harder it is to guess or crack. According to the current NIST revision, passwords that serve as the only factor must be at least 15 characters long. If they are only used alongside a second factor, the minimum is 8 characters. Systems should accept at least 64 characters and allow all printable characters, including spaces.
Mandatory character types, on the other hand, are explicitly ruled out. They add little security because people respond with the same patterns: a capital letter at the start, a digit and a special character at the end. Attackers know these patterns and try them first.
Passphrases: long and easy to remember
A passphrase consists of several random words, for example four or five terms that have nothing to do with each other or with the person. It is long, easy to type and easier to remember than a cryptic string of characters. Song lyrics, well-known quotes or the company name are unsuitable because they appear in attackers' word lists. A practical recommendation for companies: one minimum of 15 characters for all accounts. This keeps the rules simple and meets the stricter NIST requirement.
No forced changes without a reason
Regular forced changes sound sensible but often have the opposite effect. Anyone who has to invent a new password every three months tends to change only a digit at the end, and anyone who knows the old password can guess the new one. NIST therefore rules out periodic forced changes and instead requires a change whenever there is evidence of compromise. Typical reasons for an immediate change are:
- The password appears in a known data breach or a breach notification.
- Someone has entered it on a suspected phishing page.
- Malware was found on a device on which it was used.
- A shared password was known to someone who has left the company.
Screen new passwords against blocklists
Length alone is not enough if the password is a common one. Current guidance therefore requires new passwords to be checked against a list of commonly used, expected or compromised passwords. This includes passwords from known data breaches, dictionary words, simple sequences such as 123456 and terms from the context, such as the company name, the name of the service or the user name.
In Microsoft environments, Microsoft Entra Password Protection handles part of this task and can also block company-specific terms. Further rules belong in the policy: failed sign-in attempts are limited, and there are neither password hints nor security questions such as the name of a first pet, because the answers are often on social media.
| Old rule | Current recommendation |
|---|---|
| Mix of capitals, digits and special characters | Length counts, at least 15 characters as the only factor |
| Change every 90 days | Change only on indication of compromise |
| Paste blocked in the password field | Paste and password managers allowed |
| Security questions and password hints | No hints, no security questions |
| No check of the chosen password | Screening against common and breached passwords |
| A password alone is enough | MFA for email, remote access and admins |
Rolling out a company password manager
Long, unique passwords for dozens of services are only realistic with a password manager. That is why NIST requires systems to allow password managers and autofill, and recommends allowing paste too. Companies should use a business solution with central administration rather than leaving each employee to a private tool or the browser. Look for these features:
- Central management of users and groups, ideally linked to the company directory
- Shared vaults for teams with clearly defined permissions
- MFA for access to the password manager itself
- A recovery process for forgotten master passwords and for employees who leave
- Clear information on data location, encryption and GDPR
For the rollout itself, we recommend this sequence:
- Select a tool and define what is stored where.
- Set up administration, recovery and the shared vaults.
- Run a pilot with IT and one department.
- Train employees in the master passphrase, the password generator and autofill.
- Migrate passwords from browsers, spreadsheets and notes, then delete the old copies.
- Build in offboarding: remove access and change any shared passwords the person knew.
Administrator and service accounts
Administrator accounts need stricter rules, because a single takeover affects the whole company. Administrators use a separate account for administrative tasks and a normal account for email and browsing, both with MFA and the admin account preferably with phishing-resistant methods. Local administrator passwords on Windows computers should differ on every device. Windows LAPS generates and rotates them automatically. This does not conflict with the rule against forced changes, as nobody has to remember them.
Service accounts used by applications, backups or scanners are often forgotten and frequently have far-reaching rights. For them:
- Long, randomly generated passwords, stored in the password manager and never in plain text in scripts
- Only the permissions the service really needs, and no interactive sign-in
- A named owner and documentation of where the account is used
- A change when someone who knew the password leaves, or on any suspicion
- Where possible, managed service accounts that change their passwords automatically, such as gMSA in Active Directory
MFA: the second line of defence
Even a long, unique password can be stolen through a convincing phishing page or malware. That is why a modern policy does not rely on passwords alone. MFA should be mandatory for email, remote access, cloud services and all administrator accounts. Which methods suit which roles and how to plan the rollout is covered in our guide to introducing multi-factor authentication.
Conclusion: a modern password policy on one page
- At least 15 characters, with passphrases explicitly encouraged
- No mandatory character mix and no fixed change interval
- Immediate change on any indication of compromise
- Screening against common, breached and company-specific passwords
- A company password manager for everyone, protected by MFA
- Separate admin accounts and documented service accounts
A policy like this is easier for employees to follow and more secure than the old rules. It works best when technology and training go hand in hand, for example through regular security awareness training. If you would like to update your policy and implement the technical settings, Q-entra supports you as part of cyber security.
