Password policy
A password policy is the binding internal rule set governing how passwords are created, stored, used and changed in an organisation – today driven by length and uniqueness rather than by rigid expiry intervals.
A password policy is a supporting document within the information security management system and translates the overarching security policy into concrete rules for handling authentication credentials. It defines the minimum length and complexity a password must have, which systems additionally require multi-factor authentication, how initial and emergency passwords are issued, how passwords may be stored and transmitted, and what must happen when compromise is suspected. It therefore addresses regular staff, administrators and – through configuration baselines – the IT systems themselves, because a policy that is not technically enforced has little effect in practice.
The state of the art has shifted considerably. Germany's Federal Office for Information Security (BSI) removed the former recommendation of routine, event-independent password changes from its IT-Grundschutz compendium: forced expiry intervals predictably lead to derivatives such as "Summer2026!" and lower rather than raise security. Passwords are now changed for a reason – suspected compromise, a security incident, disclosure to third parties, or a change of responsibilities. Length and uniqueness take the place of forced rotation: the BSI ties password quality to the interplay of length and character set, so short passwords need many character classes while long passphrases work with only a few. Every account gets its own password, reuse across services must be prohibited, and new passwords should be screened against lists of known breached credentials.
Legally and normatively, the policy is not an end in itself. Article 21(2) of the NIS2 Directive – transposed into the German BSIG by the national NIS2 implementation act – requires access control policies and the use of multi-factor authentication. ISO/IEC 27001:2022 calls in Annex A 5.17 for controlled allocation and management of authentication information, and the IT-Grundschutz module ORP.4 "Identity and access management" carries the corresponding requirements on password use and password quality. Where the accounts concerned process personal data, the policy is at the same time a technical and organisational measure under Article 32 GDPR. Making it workable requires flanking measures: approved password managers, lockout or throttling after failed attempts, separate rules for privileged accounts, and awareness training that explains why the rules look the way they do.
Legal Basis
Art. 21(2) NIS2 Directive (EU) 2022/2555 together with the German NIS2 implementation act (BSIG); ISO/IEC 27001:2022 Annex A 5.17; BSI IT-Grundschutz compendium, module ORP.4 (Identity and access management); Art. 32 GDPR
Practical Example
A mid-sized plant engineering company qualifies as an important entity under NIS2 and revisits a password policy that has not been touched for years. Until now it required eight characters and a forced change every 90 days; an analysis of the directory service shows that most employees simply increment a trailing digit. The information security officer drops the expiry interval and replaces it with a minimum length of twelve characters for standard accounts, recommended passphrases of 20 characters or more, screening against a blocklist of breached passwords at the moment the password is set, and an event-driven change whenever compromise is suspected. Multi-factor authentication becomes mandatory for administrative, remote-access and email accounts, and privileged accounts draw one-time passwords from a password vault. The changes are enforced technically in group policy, approved by management, explained in a short training session and documented together with their rationale – so that the next ISO 27001 audit sees a deliberate decision aligned with current BSI guidance.