# A password policy template and how to write each section

A password policy covers scope, password rules, storage, sharing, shared accounts, two-step verification, changes, departures, violations and review.

Updated: October 16, 2026

A password policy says how people at your company create, store and change passwords, who they may tell, and what happens when someone leaves. The sample wording below maps each section to the US rules it answers to. It isn't legal advice. Have your lawyer and HR check it against your handbook and contracts.

## The rules a password policy answers to

Which of these apply depends on your business.

- NIST SP 800-63B-4, section 3.1.1.2, sets password rules for services that check passwords. When you set rules for systems your company runs, your company is that service.
- CIS Controls v8.1, from the Center for Internet Security, is a set of security practices. Safeguard 5.2 asks for unique passwords and sets length baselines.
- PCI DSS v4.0.1, the payment card data standard, applies to systems in its scope. Requirement 8 covers user IDs and sign-in, including shared accounts (8.2.2) and passwords (8.3).
- The HIPAA Security Rule (45 CFR Part 164, Subpart C) applies to covered entities and business associates for electronic protected health information. 45 CFR 164.308(a)(5)(ii)(D) is "Password management (Addressable)": "Procedures for creating, changing, and safeguarding passwords." Addressable means you assess whether the item is reasonable and appropriate for you. If it is, you implement it. If not, you document why and use an equivalent alternative where reasonable (45 CFR 164.306(d)(3)).
- The FTC Safeguards Rule (16 CFR Part 314) applies to financial institutions under the FTC's jurisdiction, such as mortgage brokers and tax preparers. Under 16 CFR 314.4(c), safeguards include letting only authorized users in, multi-factor authentication and logging what authorized users do.

## Sections and the rules behind them

| Policy section | Main rule | Related rules |
| --- | --- | --- |
| 1. Purpose and scope | HIPAA 164.308(a)(5)(ii)(D): procedures for passwords | PCI DSS 8.3.8: policies documented and given to all users |
| 2. Password requirements | NIST SP 800-63B-4, 3.1.1.2: length, no mixing rules, blocklist | CIS 5.2; PCI DSS 8.3.5 to 8.3.7 |
| 3. Storage | HIPAA 164.308(a)(5)(ii)(D): safeguarding passwords | NIST 3.1.1.2: allow password managers |
| 4. No sharing | HIPAA 164.312(a)(2)(i): unique user identification (Required) | FTC 314.4(c)(1)(i): access only for authorized users |
| 5. Shared accounts | PCI DSS 8.2.2: shared accounts only by exception | FTC 314.4(c)(8): log authorized users' activity |
| 6. Two-step verification | FTC 314.4(c)(5): multi-factor authentication | CIS 5.2: shorter minimum with a second factor |
| 7. Password changes | NIST 3.1.1.2: no scheduled changes, change after compromise | PCI DSS 8.3.8 and 8.3.9; NIST SP 800-53 AC-2 k |
| 8. Departures | HIPAA 164.308(a)(3)(ii)(C): termination procedures (Addressable) | PCI DSS 8.2.5; CIS 6.2 |
| 9. Violations | HIPAA 164.308(a)(1)(ii)(C): sanction policy (Required) | None |
| 10. Review | FTC 314.4(i): written report at least once a year | HIPAA 164.308(a)(8): periodic evaluation |

## The template

Replace the bracketed parts. "Shared account" means one login several people use, as in [What is a shared account?](/guides/shared-accounts/what-is-shared-account)

### 1. Purpose and scope

> This policy sets rules for creating, storing, sharing, changing and retiring passwords for [Company] systems and for outside services used for [Company] work. It applies to employees, temporary workers, contractors and vendor staff who use [Company] accounts.

PCI DSS 8.3.8 asks that password policies be written down and given to all users. Contractors and vendor staff are bound by their contracts, not your handbook, so put the same duties there.

### 2. Password requirements

> Passwords must be at least 15 characters, or at least 8 characters on systems that require a second sign-in factor. Don't reuse a password across services. [Company] systems check new passwords against a list of common and compromised passwords. First-time passwords must be unique and changed at first sign-in.

The numbers follow NIST SP 800-63B-4, section 3.1.1.2, and they also meet CIS safeguard 5.2 (14, or 8 with a second factor). NIST bans mixing rules, so the template has none. For systems in PCI DSS scope, add: "These systems also require at least 12 characters with both letters and numbers, and a new password can't match any of the last four" (8.3.6 and 8.3.7). PCI DSS 8.3.5 covers first-time passwords. [How long should a password be?](/guides/shared-accounts/password-length-recommendations) compares the sources.

### 3. Storage

> Store work passwords only in the password manager [Company] provides. Don't record them on paper, in spreadsheets, in chat or email, or in a browser's saved passwords.

HIPAA's password management item includes safeguarding passwords. CISA's guidance for businesses recommends a company-wide password manager, and NIST requires services to allow password managers and autofill. [Can employees keep work passwords in their personal password manager?](/guides/shared-accounts/personal-password-manager-at-work) explains why personal vaults are excluded.

### 4. No sharing

> Your password is for you alone. Don't give it to anyone, including managers, IT staff or anyone who contacts you offering support.

HIPAA requires a unique name or number to identify and track each user (164.312(a)(2)(i)). NIST SP 800-63B-4 assumes users protect their sign-in secrets and don't disclose them to others.

### 5. Shared accounts

> An account used by more than one person needs IT approval and an entry in the shared account register. The register lists the service, account name, owner, users, where the password is kept, where two-step verification codes go, and the date last reviewed. Each use of a shared account must be recorded in a way that identifies the person.

PCI DSS 8.2.2 allows shared accounts only when necessary, as an exception. Management must approve their use, and the business reason must be written down. Each person's identity must be confirmed before access, and every action must be traceable to one person. The FTC Safeguards Rule asks you to monitor and log what authorized users do. A service's records show only the account name, so decide here how you'll tie each use to a person. [How to take inventory of shared accounts](/guides/shared-accounts/shared-account-inventory) covers the register.

### 6. Two-step verification

> Turn on two-step verification wherever a service offers it. Use an authenticator app or a security key where you can, and text-message codes only when there's no other choice. Codes for shared accounts go only where the register says.

If the FTC Safeguards Rule covers you, it requires multi-factor authentication for anyone accessing any information system. The exception is when your Qualified Individual, the person who runs your security program, approves equivalent or stronger controls in writing. [What is two-step verification?](/guides/shared-accounts/what-is-two-step-verification) compares the methods.

### 7. Password changes

> Change a password right away when there's any sign or suspicion that it was compromised. Change a shared account's password when anyone who knows it leaves, changes roles or ends a contract. [Company] doesn't require scheduled changes, except on PCI DSS systems where the password is the only sign-in factor.

NIST says services shall not require scheduled changes and shall force a change after evidence of compromise. PCI DSS 8.3.8 asks policies to tell users to change a password on suspicion of compromise. Requirement 8.3.9 keeps the 90-day change only where the password is the only factor, unless access is decided by real-time risk analysis. Shared accounts get their own trigger, as in NIST SP 800-53 control AC-2 k. [Do passwords still need to be changed every 90 days?](/guides/shared-accounts/periodic-password-change) explains why.

### 8. Departures and role changes

> When a person leaves, or their role or contract changes, IT disables the accounts assigned to that person right away and changes shared account passwords under section 7. IT checks the shared account register to confirm nothing was missed and keeps a record of the check.

HIPAA lists termination procedures as addressable. PCI DSS 8.2.5 says access for people who leave is revoked immediately. CIS safeguard 6.2 asks for a set process for revoking access.

### 9. Violations

> Violations of this policy are handled under [Company]'s disciplinary policy. For contractors and vendor staff, the contract applies.

HIPAA requires sanctions against workforce members who don't follow security policies. Keep the penalties in your HR policy.

### 10. Review

> [IT owner] reviews this policy and the shared account register at least once a year and reports the results to [leadership].

The FTC Safeguards Rule has the Qualified Individual report to the board in writing at least once a year. HIPAA asks for periodic evaluation.

## Decide these before you write

First, choose the password manager and how you'll tie each use of a shared account to a person. Sections 3 and 5 depend on both. Second, work out which rules apply to you: PCI DSS for card systems, HIPAA, the FTC Safeguards Rule. Third, decide whether contractors fall under the policy. If so, put the same terms in their contracts, as covered in [What your vendor contract should say about accounts](/guides/outsourcing-access/contract-clauses-for-accounts).


## Frequently asked questions

**How long should our policy say passwords must be?**

NIST SP 800-63B-4 asks for 15 characters when the password is the only factor and 8 with a second factor. That also meets CIS safeguard 5.2. Systems in PCI DSS scope need at least 12 characters with both letters and numbers.

**Should the policy require changing passwords every 90 days?**

Not for accounts one person uses. NIST says services shall not require scheduled changes and shall force one after a compromise. PCI DSS keeps 90 days only where the password is the only factor. Shared accounts need their own rule.

**Is HIPAA's password management rule optional?**

It's addressable, which isn't optional. You assess whether it's reasonable and appropriate. If it is, you implement it. If not, you document why and use an equivalent alternative if that is reasonable and appropriate.

**What goes in a shared account register?**

The service, account name, owner, users, where the password is kept, where two-step verification codes go, and the date last reviewed. The policy also says how each use is tied to a person.

## Sources

- [NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (July 2025)](https://pages.nist.gov/800-63-4/sp800-63b.html)
- [NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations (AC-2)](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf)
- [CIS Controls Assessment Specification for Controls v8.1: CIS Control 5, Account Management](https://cas.docs.cisecurity.org/en/latest/source/Controls5/)
- [CIS Controls Assessment Specification for Controls v8.1: CIS Control 6, Access Control Management](https://cas.docs.cisecurity.org/en/latest/source/Controls6/)
- [PCI SSC: PCI DSS v4.0 Self-Assessment Questionnaire C (requirement text for 8.2 and 8.3)](https://listings.pcisecuritystandards.org/documents/PCI-DSS-v4-0-SAQ-C.pdf)
- [PCI SSC blog: Just Published: PCI DSS v4.0.1](https://blog.pcisecuritystandards.org/just-published-pci-dss-v4-0-1)
- [PCI SSC FAQ 1590: Do PCI DSS Requirements 8.3.9 and 8.3.10.1 apply to all system components?](https://www.pcisecuritystandards.org/faqs/1590/)
- [eCFR: 45 CFR 164.302, Applicability (HIPAA Security Rule)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.302)
- [eCFR: 45 CFR 164.306, Security standards: General rules](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.306)
- [eCFR: 45 CFR 164.308, Administrative safeguards](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308)
- [eCFR: 45 CFR 164.312, Technical safeguards](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312)
- [eCFR: 16 CFR 314.1, Purpose and scope (FTC Safeguards Rule)](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314/section-314.1)
- [eCFR: 16 CFR 314.4, Elements (FTC Safeguards Rule)](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314/section-314.4)
- [CISA: Require Strong Passwords (small and medium businesses)](https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/require-strong-passwords)

## How Junify handles this

**Doing this by hand** To keep shared accounts safe, you track who knows each password, and change it and send out the new one whenever someone leaves. You also keep a separate record of who did what under the same login.

**With Junify** With Junify, your admin adds a shared account's username and password, and people verify on their own phone and click to sign in. Each use is recorded by person, which gives section 5 its way to tell who used a shared account. For sections 7 and 8, change the password when you add the account, so nobody using it knows the new one. When someone leaves, remove their access in Junify instead of changing the password and sending it out again.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&scenario=shared-accounts&from=guide&cluster=shared-accounts&slug=password-policy-template)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)

## More on this topic

- [How 1Password and Junify differ for shared accounts](/guides/shared-accounts/1password-and-junify): 1Password fits storing and sharing each employee's own passwords. Junify fits shared accounts people should use without seeing the password. You can run both.
- [How Bitwarden and Junify differ for shared accounts at work](/guides/shared-accounts/bitwarden-and-junify): Bitwarden fits employees who keep their own passwords and share some with trusted coworkers. Junify fits shared accounts used without seeing the password.
- [Should employees save work passwords in the browser?](/guides/shared-accounts/browser-saved-passwords-at-work): Fine for a person's own work login, in a company-managed profile, on a device only they use. Avoid it for shared accounts, personal devices and personal sync.