How to Create a Strong Password Policy for Your Company

Every IT team has seen it: a careful password policy that lives in a shared drive, gets read by nobody, and changes nothing. Meanwhile someone shares a login with a colleague on leave, keeps a sticky note under the keyboard, and reuses the same password for the payroll portal and their personal email. The fix isn't stricter rules. It's rules people can actually follow, backed by layers that stop one weak password from opening the whole company.

Start With What You're Actually Defending Against

Attackers rarely sit at a keyboard guessing. They buy lists of email and password pairs leaked from other sites, then try them against your VPN, your Microsoft 365 tenant, your invoicing tool. That's credential stuffing, and it works because people reuse passwords. Other common approaches include spraying one weak password across many accounts to stay under lockout thresholds, and phishing pages that collect whatever a tired employee types in at 5pm.

Knowing this shapes the policy. You need a minimum length that resists guessing, a blocklist that stops the most-used passwords, and multi-factor authentication for anything that touches company data. You do not need to make life difficult for the person resetting their password on a Monday morning.

Set a Length Minimum That Means Something

Length is the single most useful requirement you can set. Fourteen characters is a reasonable floor for standard accounts; sixteen or more for administrators, finance staff and anyone with access to customer data. Encourage passphrases rather than scrambled strings — odd-marble-sundial-quarter is easier to remember than X7#kq2!v and considerably harder to crack.

Two practical details people forget:

• Allow a generous maximum. Systems that silently truncate a 40-character password to 12 break password managers and confuse users. If you can't accept long inputs, fix the system rather than lowering the limit.
• Permit spaces and symbols. Spaces make passphrases work. Restricting the character set weakens everything you're trying to protect.

Then block the obvious. Reject the most commonly used passwords, your company name, product names, seasons with a year appended, and anything found in a public breach corpus. Modern identity platforms do this natively, and it's more effective than any composition rule you can write.

Complexity: Keep It Light, or Skip It

Forced complexity has a predictable failure mode. When you require an uppercase letter, a number and a symbol, a lot of people produce Summer2024! — which satisfies the rule and appears in every cracking dictionary worth owning. Length plus a blocklist beats composition almost every time.

That said, some regulatory or contractual frameworks still mandate composition rules and periodic rotation. If yours does, follow it, but keep the rules minimal and pair them with a breach-list check. Don't extend rotation to systems that don't require it: forcing a change every 60 days encourages incremental passwords like Autumn2024 becoming Winter2024. Change a password when there's a reason to — a suspected compromise, a departing employee with shared credentials, a breach at a third-party service.

Give feedback at the point of reset

A strength meter with plain guidance ("too short", "found in a known breach") teaches as it enforces. It also reduces helpdesk calls, because people can see what's wrong before they hit submit rather than after.

Multi-Factor Authentication Is the Real Safety Net

MFA is what keeps a stolen password from becoming a breach. Roll it out in priority order: email and your identity provider first, then VPN and remote access, then admin consoles, finance systems and anything holding customer records.

Not all MFA is equal. SMS codes can be intercepted and are worth avoiding where you have a choice. Authenticator apps with number matching are a solid default. Hardware security keys, or platform passkeys, are the strongest option and belong on administrator and finance accounts. If you use push notifications, enable number matching and limit how many prompts can be sent — otherwise staff get trained to approve anything that buzzes, and an attacker holding the password can simply send prompts until someone taps yes.

Roll It Out Without a Staff Revolt

Security policies fail socially before they fail technically. A few things make the difference:

1. Explain the why in one paragraph. "These credentials appear in breach lists" lands better than "compliance requires it."
2. Phase it by group. Start with IT and a willing department, fix the friction, then widen the scope.
3. Use a grace period. Warn users at login for two weeks before enforcement, rather than locking accounts on a Monday morning.
4. Staff the helpdesk. Expect a spike in calls during the first week and plan cover for it.
5. Approve a password manager. Telling people to use unique passwords while blocking the tool that makes it possible is a contradiction they'll resolve by reusing passwords.
6. Never email passwords in plain text, and confirm self-service reset works before you enforce anything.

Get managers to go first. Nothing undermines a policy faster than a leadership team that quietly sits outside it.

Support the Policy With Tools, Not Willpower

Single sign-on removes dozens of passwords from daily life, which is a security win dressed up as a convenience. Pair it with self-service password reset, MFA enrolment during onboarding rather than "later", separate administrator accounts for IT staff, and a documented process for service accounts and shared mailboxes. Log authentication events and review failed sign-in spikes monthly. That's how you catch an attack in progress instead of reading about it afterwards.

Review It Once a Year — and After Every Incident

A password policy isn't a document you write once. Put a review on the calendar: check whether the length minimum still makes sense, whether the blocklist is still updating, and whether MFA coverage has gaps after the last new SaaS tool or acquisition. After any credential-related incident, ask what rule or control would have stopped it and adjust.

Write the policy in plain language, keep it to two pages, and make the first version easy enough that nobody needs to work around it. A policy people actually follow beats a perfect one they ignore.

Photo: geralt / Pixabay