Password Policy Best Practice for 2026: Length, Not Forced Resets

What changed: the old rules vs current guidance

The US National Institute of Standards and Technology (NIST) publishes the Digital Identity Guidelines that most password policies trace back to. The current version, SP 800-63B-4, uses "SHALL NOT" language for two habits many offices still have: it says verifiers shall not impose composition rules such as mixtures of character types, and shall not require users to change passwords periodically. It does require a forced change when there is evidence the password has been compromised.

Microsoft and Google have followed. Microsoft's password policy recommendations say its latest guidance discourages expiration for cloud-only accounts, and Google's Workspace admin help says expiration is off by default "because research has shown little positive impact on security".

Why forced resets and complexity rules backfire

When people must change a password every 90 days, they make small, predictable changes: Summer2026! becomes Autumn2026!. When they must include a symbol, they add an exclamation mark at the end. Attackers know these patterns and build them into their guessing lists. Microsoft's guidance puts it bluntly: length, special character and change requirements "result in normalization of passwords, which makes it easier for attackers to guess or crack passwords".

Length works differently. Each extra character multiplies the number of possible passwords, and a four- or five-word passphrase is both longer and easier to remember than a short jumble. The Cyber Security Agency of Singapore's strong password advice recommends a long and random password of at least 12 characters, built from words tied to a memory, plus two-factor authentication.

A password policy for a small business, in seven rules

This is the core of a modern policy. It fits on one page and staff can actually follow it.

1. Length first. Use a passphrase of at least 15 characters for any account protected by a password alone, and at least 12 for accounts that also use MFA. Longer is fine.
2. No reuse. Every work account gets its own password. Reuse is how one breached website becomes a breached mailbox.
3. Use the company password manager. It creates and fills long random passwords, so nobody has to remember them. Our password manager guide compares options.
4. MFA on everything that offers it. Email, admin consoles, banking, accounting, domain registrar and social media first.
5. No scheduled resets. Change a password only if it may be known: phishing, a breach notice, malware, or a shared password after someone leaves.
6. Never share by chat or email. Share through the password manager's shared vaults, with access removed when roles change.
7. Report straight away. If you typed a password into a suspicious page, tell IT immediately. No blame, just a fast reset.

Microsoft 365 and Google Workspace settings to match

Both platforms already behave close to current guidance by default. The work is mostly checking that nobody changed the defaults years ago and that MFA is enforced.

1. 1

   Microsoft 365: check password expiration

   In the Microsoft 365 admin centre, go to Settings, Org settings, Security and privacy, Password expiration policy. Microsoft says passwords never expire by default; make sure the never-expire option is set.

2. 2

   Microsoft 365: rely on banned password lists

   Microsoft Entra Password Protection applies a global banned password list to cloud-only users on Entra ID Free. A custom list (your company name, products, suburb) needs Entra ID P1 or P2, included in Microsoft 365 Business Premium.

3. 3

   Google Workspace: set strength and length

   In the Admin console, go to Security, Authentication, Password management. Tick Enforce strong password and set a minimum length; Google allows 8 to 100 characters. A minimum of 12 to 15 is reasonable for most teams.

4. 4

   Google Workspace: leave expiration off

   Keep password reset frequency set to never expire unless a contract or audit specifically requires otherwise.

5. 5

   Both: enforce MFA

   Turn on security defaults or Conditional Access in Microsoft 365, or enforce 2-Step Verification in Google Workspace. Our MFA set-up guide walks through each.

6. 6

   Both: tell staff before you change length rules

   Raising the minimum length usually applies at the next password change. Send the one-page policy first so nobody is surprised.

When you should force a password reset

Dropping scheduled resets does not mean never resetting. NIST requires a forced change when there is evidence of compromise. In a small business, that usually means:

• Someone entered their password on a phishing page or opened a suspicious attachment.
• The address appears in a new breach notification and the password may have been reused.
• Malware was found on a device used to sign in.
• A shared account password was known to someone who has left the business.
• Unusual sign-ins appear in the Microsoft 365 or Google Workspace security logs.

When you reset after a compromise, also sign the user out of all sessions and review MFA methods and mailbox forwarding rules, because attackers often add their own. Our hacked business email guide has the full first-hour checklist.

Do it yourself or get help?

A one-person or five-person office can adopt this policy in an afternoon: write the seven rules into the handbook, check the expiry and MFA settings, and set up a password manager.

If you would rather have it done for you, our Password Manager Rollout (S$290) sets up shared vaults and staff onboarding, and Microsoft 365 / Google Security Lockdown (S$590) enforces MFA for up to 15 users, blocks legacy sign-in and cleans up admin roles, with a before and after report.