Implement a robust password policy covering complexity requirements, rotation schedules, MFA enforcement, and privileged account management.
Weak passwords remain one of the most exploited vulnerabilities in UK businesses. This template provides a comprehensive password policy covering complexity requirements, rotation schedules, multi-factor authentication enforcement, and privileged account management. It aligns with current NCSC guidance, which favours longer passphrases over complex rotation, and includes implementation guidance for Active Directory and Microsoft 365 environments.
IT administrators, security officers, and compliance managers at UK businesses who need to implement or update their password policy to meet current best practices and compliance requirements.
Current NCSC guidance favours long, memorable passphrases over complex rotation rules, since forced frequent changes tend to encourage weaker, predictable passwords. Combine minimum length requirements with mandatory multi-factor authentication and a password manager rather than relying on complexity alone.
No - NCSC and most current security guidance recommend against mandatory periodic changes for standard accounts, since it drives poor habits like minor variations of the same password. Changes should instead be triggered by evidence of compromise, with MFA doing the heavier lifting on account security.
Yes - MFA blocks the large majority of automated account takeover attempts even when a password is compromised, making it one of the highest-value, lowest-cost security controls available. Most UK SMEs can enable it across Microsoft 365 or Google Workspace at no extra licence cost.
Set clear minimum length and MFA requirements, define rules for privileged and admin accounts separately from standard users, and specify an approved password manager rather than leaving storage to individual choice. This template provides ready-to-adapt wording aligned with current NCSC guidance.
Powered by industry-leading technologies including SolarWinds, Cloudflare, BitDefender, AWS, Microsoft Azure, and Cisco Meraki to deliver secure, scalable, and reliable IT solutions.
14 Oct, 2026
Network change management is the discipline of planning, approving, carrying out and checking changes to network infrastructure so that routine work does not...
13 Oct, 2026
Evaluating office location IT infrastructure is the step most UK businesses skip when choosing new premises, and the one most likely to cost them after the...
12 Oct, 2026
Remote IT support exposes an assumption most support models never had to state: that a technician can walk over. Look at a traditional support arrangement and...