Two password policy templates in line with Cyber Essentials: twelve characters or more with no forced changes, and multi-factor authentication on email and cloud services.
This policy template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:
- Policy number and title
- Information-classification
- Version
- Page number / total pages
alphaZ documents - beautifully designed, tried and tested policy templates. No junk, jargon or unnecessary content. Simple and usable policy templates
developed over 25 years through practical use in the real world.
Further guidance on passwords and authentication:
Download this policy template with your company name and logo already added!
Document Preparation available with all document toolkits.
To get access to this file please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files to view all the files available to download. This policy is also included in the ISO 27001 Toolkit and every alphaZ ISO toolkit that covers ISO 27001, so the toolkit route gives you this file plus everything else you need in one download.
If you'd like this policy prepared for your organisation along with the rest of your company policies, or help with your information security risk assessment and treatment plan, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.
Password Policy Template
A password policy template setting out how passwords are managed so they are protected and secure, supplied with a second version, the Password and Secure Authentication Policy, which adds a rule for recording the issue of log-ins.
The policy has Approved By and Date Approved fields and carries a Public information classification, so it can be shared with workers, clients and other interested parties.
What the Password Policy Covers
- Sharing - passwords never shared, inside or outside the organisation
- Compromise - passwords changed immediately and the matter reported if they may have been disclosed
- Strength - at least 12 characters with no maximum length, three or more random words encouraged, and no names or personal details
- Unique passwords - a different password for each login and account
- Default passwords - changed to a strong, unique password before a device, system or account is used, and emailed reset passwords changed at first log-in
- Training - IT security training so users recognise attacks such as phishing
- Storage - not written down where they can be found, and only stored electronically in an approved password manager
- Multi-factor authentication - always used for email and other cloud services, and wherever else it is available
Two Versions Supplied
The download includes P-27 Password Policy and P-27A Password and Secure Authentication Policy. P-27A has the same rules and adds that the issue of log-ins and passwords is recorded, but the passwords themselves are never written in the record.
Checked Against Cyber Essentials
The IT policies in the range have been checked against the Cyber Essentials requirements, so their rules on passwords, devices, access and updates do not contradict what a Cyber Essentials assessment asks for.
Using the Policy
Add your company name and logo, check each commitment matches what your organisation does and edit any that do not, then approve and date the policy and share it with workers and anyone else who needs to see it.
Who Needs a Password Policy?
Organisations applying for Cyber Essentials, organisations working to ISO 27001, and any organisation whose workers log in to business systems or cloud services.
Included in the ISO 27001 Toolkit
This policy is part of the ISO 27001 Toolkit and every alphaZ ISO toolkit that covers ISO 27001.
Works with the Authentication Procedure
The PP-8-10 User Secret Authentication Policy Procedure covers authentication information, and the same rules are included as the Password and Secure Authentication Policy section of the PP-8-100 Information Security Policy Procedure.
Related Policies
Would you rather we prepared it for you?
Our Company Forms, Policies and HR Reset service prepares your policy set, staff handbook and HR forms as one branded set, tailored to how you actually run things.
Company Forms, Policies and HR Reset