How to Create a Password Policy for Your Business

A weak or absent password policy is one of the most common findings in security audits. Whether you're a startup with five employees or an enterprise with thousands, a clear, enforced password policy dramatically reduces your attack surface. This guide walks you through what to include — and what outdated advice to leave out.

Why you need a written password policy

Without a policy, employees make their own decisions — and those decisions are often insecure. A written policy:

• Sets clear expectations everyone can follow
• Creates a consistent security baseline across all accounts and systems
• Provides a reference for security training and onboarding
• Demonstrates due diligence to regulators, auditors, and clients (SOC 2, ISO 27001, HIPAA, PCI-DSS)
• Gives IT a basis to enforce requirements technically

What NIST says in 2024

The National Institute of Standards and Technology (NIST) Special Publication 800-63B is the authoritative guidance on password policies. The 2024 revision made several counterintuitive recommendations that differ from conventional wisdom:

Core elements of a password policy

1. Minimum length

NIST requires a minimum of 8 characters and recommends systems support up to at least 64 characters. For most business systems, a 12–16 character minimum is a practical starting point. For privileged accounts (admins, service accounts), require 20+.

2. Character requirements (simplified)

Rather than mandating complex rules ("must have uppercase, lowercase, number, and symbol"), require a minimum length and block commonly-used passwords. A 16-character lowercase passphrase has more entropy than an 8-character "complex" password.

3. Banned password lists

Your policy should require the technical implementation to block:

• Passwords in known breach databases (Have I Been Pwned has a free API)
• Common passwords (the top 10,000 list)
• Passwords containing the username or organization name
• Keyboard walks (qwerty, 123456, asdfgh)

4. Password storage (for technical teams)

Your policy should specify how passwords are stored in your systems: using bcrypt, Argon2, or scrypt with appropriate work factors. Never MD5, SHA-1, or SHA-256 alone for password storage. Never plaintext.

5. Account lockout

After 5–10 failed attempts, lock the account temporarily (30–60 minutes) or require administrator unlock. This prevents both brute force and credential stuffing attacks.

6. Multi-factor authentication

For most modern businesses, MFA should be mandatory — not optional. At minimum, require it for:

• Remote access (VPN, SSH)
• Administrative accounts
• Systems containing sensitive data (HR, financial, customer PII)
• Email (the master key to all other accounts)

7. Password managers

NIST now explicitly recommends allowing (and encouraging) password managers. Your policy should endorse their use and ideally provide an approved business password manager (1Password Teams, Bitwarden Business, etc.) to all employees.

Generate your policy now

Use our Password Policy Generator to create a complete, customizable password policy document. Choose from Basic, Standard, Strong, or Enterprise presets — then download as a .txt file and adapt it for your organization.

Making the policy stick

A policy that exists only as a PDF nobody reads is worthless. Enforcement requires:

• Technical enforcement — configure your identity provider (Okta, Azure AD, Google Workspace) to enforce length, reject common passwords, and require MFA.
• Security awareness training — employees need to understand why the policy exists, not just what it says.
• Clear consequences — the policy should state the disciplinary actions for knowingly violating it.
• Regular review — review the policy annually and after any security incident to incorporate lessons learned.

Frequently asked questions