Writing a password policy in 2026: what current NIST guidance actually says
Many small-business password policies were written years ago and still require eight characters, one capital letter, one symbol and a new password every 90 days. Current US government guidance says most of that is counterproductive. If you are writing or updating a password policy, here is what changed and how to put it into plain policy language.
The source: NIST SP 800-63B-4
The US National Institute of Standards and Technology published the fourth revision of its digital identity guidelines in 2025. Its authentication volume, NIST SP 800-63B-4, is written for organizations that run login systems, but it's widely used as a benchmark for workplace password rules. Key points from its password section:
- Length: passwords used as the only factor must be at least 15 characters. Passwords used as part of multi-factor authentication may be shorter, but at least 8 characters.
- Long passwords allowed: systems should permit at least 64 characters and accept spaces, so passphrases work.
- No composition rules: systems shall not require mixtures of character types (the "one uppercase, one symbol" rule).
- No forced periodic changes: systems shall not require password changes on a schedule, but must force a change when there's evidence of compromise.
- No hints or security questions when choosing passwords.
The same guidance also says new passwords should be checked against lists of commonly used, expected or compromised passwords, and that password managers and paste should be allowed.
Why the old rules backfired
Complexity rules and 90-day rotation push people toward predictable patterns ("Summer2026!" becoming "Autumn2026!"), sticky notes and reuse across sites. Length plus a blocklist plus MFA protects better and is easier for staff.
What to put in a small-business password policy
1. Length, not complexity
Set a minimum length and encourage passphrases of several random words. If every system your staff use enforces MFA, NIST's floor is 8 characters, but most businesses choose longer for comfort. If any system still allows password-only login, use at least 15 for it. Use longer minimums for admin and service accounts.
2. Change on compromise, not on a calendar
Require a change when a password may have been exposed: a phishing click, a breach notice, a shared screen or a departing employee who knew it.
3. A company password manager
Unique passwords for every account are only realistic with a password manager. Name the approved one in the policy, require it for work accounts, and ban storing passwords in browsers on shared devices, spreadsheets or notes.
4. MFA wherever it's available
The password is only half of the login. Require MFA on email, remote access, admin accounts, banking and anything holding sensitive data, and prefer authenticator apps or security keys over text messages. See our MFA guide for the logins insurers commonly ask about.
5. Never share, never reuse
No shared logins (use proper shared mailboxes or delegated access), no reuse of work passwords on personal sites, and nobody, including IT, will ever ask for your password.
6. Admin and service accounts
Separate admin accounts from daily-use accounts, use longer passwords and phishing-resistant MFA, and keep a list of service accounts with an owner for each.
7. Technical settings to match
A policy only works if systems back it up: turn on banned-password lists where your platform offers them (Microsoft Entra ID and Google Workspace both have password controls), set lockout or throttling after repeated failures, and disable legacy sign-in protocols.
A template that already follows this
Our Password & MFA Policy template is written around these principles: length over complexity, change-on-compromise, password managers, MFA requirements and separate admin accounts. Minimum lengths are editable [BRACKETED] fields (default 14 for users and 16 for admins, with MFA required). Raise them to 15+ if any of your systems allow password-only login. It is also included in the Starter Kit.