What Is Password Policy?

Password policy guidance changed substantially, and most organisational policies have not caught up. The rules many enterprises still enforce — mandatory complexity, forced rotation every ninety days — are now recognised as reducing security rather than improving it.

The reasoning is behavioural. Rules that make passwords hard to remember produce predictable workarounds, and predictable is exactly what an attacker needs.

What current guidance actually says

Length over complexity. A long passphrase is stronger and more memorable than a short string with substitutions. Character composition rules push people toward patterns — a capital at the start, a digit and an exclamation mark at the end — which cracking tools model directly.

No forced periodic rotation. Rotation on a schedule produces incremental variants and written-down passwords. Rotate on evidence of compromise instead, which is when it actually matters.

Check against known breached passwords. This is the highest-value single change available. Credential stuffing uses passwords exposed elsewhere, and blocking known-breached values at the point of choice addresses the actual attack.

Allow paste and password managers. Blocking them prevents the one behaviour that reliably produces strong unique passwords.

Why old policies persist

Compliance frameworks and auditor expectations lag, and changing a policy that an assessor has previously accepted requires justification. Several major standards now explicitly permit or recommend the modern approach, which makes the argument easier than it was.

The practical position is that if you must retain rotation for a specific compliance requirement, do so for the accounts that requirement covers rather than universally.

Where password policy stops being the question

All of this concerns the weakest factor. Where multi-factor authentication is enforced and phishing-resistant, password strength matters much less — and passwordless authentication removes the question entirely.

Effort spent perfecting password rules on systems that still accept a password alone is effort directed at the wrong problem.

Reset and recovery is where accounts are actually taken over

A great deal of effort goes into password rules and comparatively little into the process for replacing a forgotten one. That process is the real target: if an attacker can persuade a service desk to reset a password or register a new authentication factor, every rule above it is irrelevant.

Knowledge-based verification — date of birth, employee number, a manager’s name — is weak, because that information is discoverable. Stronger approaches verify through a channel already associated with the account, require a video call for privileged resets, or route confirmation through the person’s manager. Help desk procedure is a security control and deserves to be written as one.

The direction of travel is away from passwords entirely. Passkeys and platform authenticators remove the shared secret, which removes phishing, reuse, spraying and stuffing in one step rather than mitigating each. Adoption is uneven and legacy systems will hold the question open for years, and any new system being designed now has little reason to centre a password.

Where to start

Enable breached-password checking if your platform supports it, and stop forcing periodic rotation unless a specific requirement demands it. Both changes improve security and reduce support calls.

See MFA. GuardsArm runs security risk assessments.