A password policy template and how to write each section

A password policy says how people at your company create, store and change passwords, who they may tell, and what happens when someone leaves. The sample wording below maps each section to the US rules it answers to. It isn’t legal advice. Have your lawyer and HR check it against your handbook and contracts.

The rules a password policy answers to

Which of these apply depends on your business.

• NIST SP 800-63B-4, section 3.1.1.2, sets password rules for services that check passwords. When you set rules for systems your company runs, your company is that service.
• CIS Controls v8.1, from the Center for Internet Security, is a set of security practices. Safeguard 5.2 asks for unique passwords and sets length baselines.
• PCI DSS v4.0.1, the payment card data standard, applies to systems in its scope. Requirement 8 covers user IDs and sign-in, including shared accounts (8.2.2) and passwords (8.3).
• The HIPAA Security Rule (45 CFR Part 164, Subpart C) applies to covered entities and business associates for electronic protected health information. 45 CFR 164.308(a)(5)(ii)(D) is “Password management (Addressable)”: “Procedures for creating, changing, and safeguarding passwords.” Addressable means you assess whether the item is reasonable and appropriate for you. If it is, you implement it. If not, you document why and use an equivalent alternative where reasonable (45 CFR 164.306(d)(3)).
• The FTC Safeguards Rule (16 CFR Part 314) applies to financial institutions under the FTC’s jurisdiction, such as mortgage brokers and tax preparers. Under 16 CFR 314.4(c), safeguards include letting only authorized users in, multi-factor authentication and logging what authorized users do.

Sections and the rules behind them

The template

Replace the bracketed parts. “Shared account” means one login several people use, as in What is a shared account?

1. Purpose and scope

This policy sets rules for creating, storing, sharing, changing and retiring passwords for [Company] systems and for outside services used for [Company] work. It applies to employees, temporary workers, contractors and vendor staff who use [Company] accounts.

PCI DSS 8.3.8 asks that password policies be written down and given to all users. Contractors and vendor staff are bound by their contracts, not your handbook, so put the same duties there.

2. Password requirements

Passwords must be at least 15 characters, or at least 8 characters on systems that require a second sign-in factor. Don’t reuse a password across services. [Company] systems check new passwords against a list of common and compromised passwords. First-time passwords must be unique and changed at first sign-in.

The numbers follow NIST SP 800-63B-4, section 3.1.1.2, and they also meet CIS safeguard 5.2 (14, or 8 with a second factor). NIST bans mixing rules, so the template has none. For systems in PCI DSS scope, add: “These systems also require at least 12 characters with both letters and numbers, and a new password can’t match any of the last four” (8.3.6 and 8.3.7). PCI DSS 8.3.5 covers first-time passwords. How long should a password be? compares the sources.

3. Storage

Store work passwords only in the password manager [Company] provides. Don’t record them on paper, in spreadsheets, in chat or email, or in a browser’s saved passwords.

HIPAA’s password management item includes safeguarding passwords. CISA’s guidance for businesses recommends a company-wide password manager, and NIST requires services to allow password managers and autofill. Can employees keep work passwords in their personal password manager? explains why personal vaults are excluded.

4. No sharing

Your password is for you alone. Don’t give it to anyone, including managers, IT staff or anyone who contacts you offering support.

HIPAA requires a unique name or number to identify and track each user (164.312(a)(2)(i)). NIST SP 800-63B-4 assumes users protect their sign-in secrets and don’t disclose them to others.

5. Shared accounts

An account used by more than one person needs IT approval and an entry in the shared account register. The register lists the service, account name, owner, users, where the password is kept, where two-step verification codes go, and the date last reviewed. Each use of a shared account must be recorded in a way that identifies the person.

PCI DSS 8.2.2 allows shared accounts only when necessary, as an exception. Management must approve their use, and the business reason must be written down. Each person’s identity must be confirmed before access, and every action must be traceable to one person. The FTC Safeguards Rule asks you to monitor and log what authorized users do. A service’s records show only the account name, so decide here how you’ll tie each use to a person. How to take inventory of shared accounts covers the register.

6. Two-step verification

Turn on two-step verification wherever a service offers it. Use an authenticator app or a security key where you can, and text-message codes only when there’s no other choice. Codes for shared accounts go only where the register says.

If the FTC Safeguards Rule covers you, it requires multi-factor authentication for anyone accessing any information system. The exception is when your Qualified Individual, the person who runs your security program, approves equivalent or stronger controls in writing. What is two-step verification? compares the methods.

7. Password changes

Change a password right away when there’s any sign or suspicion that it was compromised. Change a shared account’s password when anyone who knows it leaves, changes roles or ends a contract. [Company] doesn’t require scheduled changes, except on PCI DSS systems where the password is the only sign-in factor.

NIST says services shall not require scheduled changes and shall force a change after evidence of compromise. PCI DSS 8.3.8 asks policies to tell users to change a password on suspicion of compromise. Requirement 8.3.9 keeps the 90-day change only where the password is the only factor, unless access is decided by real-time risk analysis. Shared accounts get their own trigger, as in NIST SP 800-53 control AC-2 k. Do passwords still need to be changed every 90 days? explains why.

8. Departures and role changes

When a person leaves, or their role or contract changes, IT disables the accounts assigned to that person right away and changes shared account passwords under section 7. IT checks the shared account register to confirm nothing was missed and keeps a record of the check.

HIPAA lists termination procedures as addressable. PCI DSS 8.2.5 says access for people who leave is revoked immediately. CIS safeguard 6.2 asks for a set process for revoking access.

9. Violations

Violations of this policy are handled under [Company]’s disciplinary policy. For contractors and vendor staff, the contract applies.

HIPAA requires sanctions against workforce members who don’t follow security policies. Keep the penalties in your HR policy.

10. Review

[IT owner] reviews this policy and the shared account register at least once a year and reports the results to [leadership].

The FTC Safeguards Rule has the Qualified Individual report to the board in writing at least once a year. HIPAA asks for periodic evaluation.

Decide these before you write

First, choose the password manager and how you’ll tie each use of a shared account to a person. Sections 3 and 5 depend on both. Second, work out which rules apply to you: PCI DSS for card systems, HIPAA, the FTC Safeguards Rule. Third, decide whether contractors fall under the policy. If so, put the same terms in their contracts, as covered in What your vendor contract should say about accounts.