In short
A password policy for business should follow the NCSC and Cyber Essentials v3.3: long passwords or MFA, a deny list for common passwords, throttling of guesses, MFA on cloud services, no forced expiry and no complexity rules, plus usable secure storage for passwords. Cyber Essentials names a password manager as one example of that storage.
Not sure where to start?
Tell us what you need to achieve and we will point you to the right option.
What the NCSC recommends
The NCSC's password policy guidance (opens in a new tab) for organisations moves away from rules that make passwords harder to remember without making them harder to crack. Its main points, in its own words:
| Topic | NCSC guidance |
|---|---|
| Password managers | "The NCSC recommend the use of password managers for secure storage wherever appropriate." |
| Pasting | "users should be allowed to paste passwords into web forms" |
| Expiry | "Regular password changing harms rather than improves security." |
| Common passwords | "Password blacklisting prevents common, guessable passwords being used." |
| Memorable passwords | "Adopting the 'three random words' technique can help users to use suitably complex passphrases that they can actually remember." |
| Internet-facing accounts | "MFA should be the primary method for protecting these accounts." |
| Lockout | "Throttling is preferred, because account lockout can leave legitimate users unable to access their accounts" |
| Default passwords | "all default vendor-supplied passwords that come with any system, software or device should be changed before deployment." |
| Complexity rules | "complexity requirements provide no defence against common attack types such as social engineering or insecure storage of passwords." |
The guidance was written for IT professionals in large organisations and the public sector, but the same principles suit a business of ten people.
Not sure which option fits? Ask us
Tell us what you need and we will help you choose the right option.
What Cyber Essentials v3.3 asks for
If you are certified, or working towards Cyber Essentials (opens in a new tab), its v3.3 requirements (April 2026) set the minimum for password-based authentication:
| Requirement | What v3.3 says |
|---|---|
| Brute-force protection | At least one of: multi-factor authentication; throttling to "no more than 10 guesses in 5 minutes"; locking devices after no more than 10 unsuccessful attempts |
| Password quality | One of: MFA; a minimum length of 12 characters with no maximum; or a minimum of 8 characters with no maximum plus automatic blocking of common passwords using a deny list |
| Cloud services | "authentication to cloud services must always use MFA" |
| Supporting users | Education on avoiding common passwords (such as using "the password generator feature built into some password managers"), encouraging three or more words, "providing usable secure storage for passwords (for example a password manager or secure locked cabinet)", not enforcing regular expiry and not enforcing complexity |
| Compromise | "an established process in place to change passwords promptly if you know or suspect a password or account has been compromised" |
A password manager helps you meet several of these points at once, but Cyber Essentials does not require one: it gives "a password manager or secure locked cabinet" as examples. Our specialist site has the full Cyber Essentials password requirements (opens in a new tab) explained, including device unlock PINs.
Password policy template
Adapt this to your organisation. Replace the bracketed text, delete what does not apply, and keep it to one page so people read it. It is built from the NCSC and Cyber Essentials v3.3 wording above.
- Scope. This policy applies to everyone who uses [Company] systems, including staff, contractors and volunteers, on company and personal devices used for work.
- Password manager. [Company] provides [password manager] for storing work passwords. Use it for every work account. Do not store work passwords in browsers, spreadsheets, documents, email or chat.
- Creating passwords. Let the password manager generate passwords for work accounts. Where you have to remember a password (your password manager, your computer, your work email), use at least three random words, and make it at least [12] characters.
- Unique passwords. Never reuse a work password anywhere else, and never use a personal password for work.
- Blocked passwords. Common and previously breached passwords are blocked where our systems support it. [Company] does not require symbols, capitals or numbers.
- No routine changes. You will not be asked to change passwords on a schedule. Change a password straight away, and tell [IT contact], if you think it has been seen, phished or exposed in a breach.
- Multi-factor authentication. MFA must be turned on for [the password manager], [email] and all cloud services that offer it. Use [approved method, for example an authenticator app or passkey]. Never approve a sign-in request you did not start.
- Sharing. Share work logins only through shared folders or vaults in [password manager], with the people who need them. Never send passwords by email, text or chat.
- Devices. Lock your devices with a PIN, password or biometrics. Default passwords on new systems and devices are changed before use.
- Leavers and role changes. [IT contact] removes access on or before a person's last day, transfers their work items and changes any shared passwords they could see.
- Help. If you forget your master password or think an account is compromised, contact [IT contact] at [contact details].
- Review. This policy is owned by [role] and reviewed every [12] months. Last reviewed: [date].
Need help choosing?
We will recommend what fits your organisation and explain why, in plain English.
Enforcing the policy with a password manager
A written policy only works if the tools make it the easy option. Business password managers let administrators turn most of the clauses above into settings:
| Password manager | Policies and enforcement | Password health | Leavers |
|---|---|---|---|
| Keeper | "Policy engine and enforcements": enforce security policies "by user, role or team"; MFA method enforced at role level (Keeper (opens in a new tab)) | Security Audit to "Monitor password strength and reuse"; BreachWatch dark web monitoring add-on | "Vault transfer" of a leaver's vault |
| 1Password Business | Custom policies and access monitoring; two-factor authentication management for team members | Watchtower alerts for weak, reused or breached passwords, with business Watchtower reports | Suspend users by deprovisioning them in your identity provider (1Password (opens in a new tab)) |
| NordPass | Password Policy and granular policies on Teams, Business and Enterprise; company-wide settings | Password Health on Business and Enterprise, judging weak passwords "based on your company's Password Policy" (NordPass (opens in a new tab)) | Item Transfer on all business plans |
| LastPass | "Essential security policies" on Teams; "100+ advanced security policies" on Business (LastPass (opens in a new tab)) | Security dashboard and dark web monitoring in every plan | Directory integrations to automate onboarding and offboarding on Business |
Each one also includes a password generator, which covers the Cyber Essentials point about helping people choose unique passwords. Our choosing a business password manager guide compares the plans in more detail.
Training staff on the policy
People follow a policy they understand. A short session when the password manager goes live, covering how to save and share logins, how to use the generator and how to spot a phishing page, does more than any document. Our sister site covers password and MFA training (opens in a new tab) for staff.
Two related guides on this site help with the practical side: how to share passwords securely and Google and Microsoft password managers at work, for moving staff off browser-saved passwords.
How we help with password policies
We can help you turn the policy into a working set-up. We can:
- Help you choose between Keeper, 1Password, NordPass and LastPass for your team size, identity platform and sharing needs
- Set up single sign-on and user provisioning (SSO and SCIM) with Microsoft Entra ID, Google Workspace or Okta where the plan supports it
- Configure password, MFA and sharing policies to match your written policy, and create shared folders or vaults for each team
- Help you import passwords from browsers, spreadsheets or another password manager
- Supply the licences; they can be billed monthly, with the plan and terms confirmed at quote
Contact us for free advice or a quote.
More on passwords at work
Frequently asked questions
Should we force password changes every 90 days?
No. The NCSC says "Regular password changing harms rather than improves security", and Cyber Essentials v3.3 lists "not enforcing regular password expiry" among the ways to support users. Change a password when you know or suspect it has been compromised (NCSC (opens in a new tab)).
Does Cyber Essentials require a password manager?
No. Cyber Essentials v3.3 asks you to provide "usable secure storage for passwords" and gives "a password manager or secure locked cabinet" as examples. A password manager is the practical choice for most organisations because it also generates unique passwords and makes sharing safer.
How long should business passwords be?
Under Cyber Essentials v3.3, at least 12 characters with no maximum, or at least 8 with a deny list of common passwords, unless MFA is used. Passwords generated by a password manager can be much longer, because nobody has to remember them.
Should we stop staff pasting passwords?
No. The NCSC recommends that "users should be allowed to paste passwords into web forms", because blocking paste stops password managers from working properly (NCSC (opens in a new tab)).
Do we still need complexity rules?
The NCSC says complexity requirements "provide no defence against common attack types", and Cyber Essentials v3.3 lists "not enforcing password complexity requirements". Length, a deny list and MFA do more.
Where should we turn on MFA first?
Start with email, the password manager itself and every cloud service: Cyber Essentials v3.3 says "authentication to cloud services must always use MFA". Our specialist site explains the Cyber Essentials MFA requirements (opens in a new tab).
Still have a question about business password policy?
Ask us and a member of our team will get back to you.