Cyber Essentials Password Policy: Requirements and a Free Template

A Cyber Essentials password policy has to meet the password rules in the NCSC’s Requirements for IT Infrastructure v3.3, which applies to assessment accounts opened from 27 April 2026 (IASME’s Danzell question set). In short: passwords need at least 12 characters, or at least 8 if the account uses multi-factor authentication (MFA) or common passwords are blocked automatically, with no maximum length. Sign-in must be protected against guessing, and you should help people choose unique passwords rather than forcing complexity rules or regular changes.

Guessed, reused and default passwords are among the simplest ways into an organisation, which is why these rules sit inside the user access control requirement. The other controls are covered in our Cyber Essentials checklist.

What are the Cyber Essentials password requirements?

v3.3 sets five password rules under user access control, with related rules on default passwords and device unlocking under secure configuration and firewalls. They apply to every in-scope account, including administrator accounts and accounts you own that an IT provider uses to manage your systems.

Last checked against NCSC v3.3 on 13 October 2026, the current version of the requirements. The NCSC publishes the full requirements on its Cyber Essentials resources page.

How long must passwords be for Cyber Essentials?

At least 12 characters, or 8 with MFA or automatic blocking of common passwords. Whichever option you use, there must be no maximum length.

A deny list blocks common and weak passwords automatically, such as “Password1” and others that appear on lists of breached passwords. It has to be automatic: a line in the staff handbook doesn’t count. Microsoft Entra ID, for example, applies its global banned password list to cloud accounts automatically, while on-premises Active Directory needs Entra Password Protection installed; for other systems, check the vendor’s documentation. Also check older apps that cap password length, as the rule says there should be no maximum.

How must password guessing be blocked?

Every password sign-in needs at least one of three protections: MFA, so a guessed password isn’t enough on its own; throttling, where each failure adds a longer wait and no more than 10 guesses are possible in 5 minutes; or lock-out after no more than 10 unsuccessful attempts.

Check each system separately. Cloud services must use MFA anyway, so the gaps are usually the Windows lock-out policy, a firewall’s admin login or a web app that allows unlimited attempts. For unlocking devices, the vendor’s default is accepted where neither throttling nor lock-out can be configured. Our guide to Cyber Essentials mobile device requirements covers phones and tablets.

How does MFA change the password rules?

MFA does two jobs in the password rules: it meets the password quality rule, as long as the password element is at least 8 characters with no maximum, and it counts as protection against guessing. It is also mandatory in its own right. Authentication to cloud services must always use MFA, and under the Danzell question set, leaving it off a cloud service that offers it fails the assessment outright. v3.3 also says you should always use MFA for administrator accounts and accounts reachable from the internet.

The password rules apply only where someone signs in with a password, and v3.3 counts FIDO2 authenticators as passkeys and regards them as MFA. Where a password is kept as a fallback for passwordless sign-in, the question set still expects it to be protected against guessing. Which factors count and whether SMS codes are acceptable are covered in our guide to Cyber Essentials MFA.

Does Cyber Essentials require password expiry or complexity rules?

No. v3.3 asks you to support users by not enforcing regular password expiry and not enforcing password complexity requirements. The NCSC’s password guidance explains why: forced changes produce predictable patterns, such as a number at the end that goes up each time, and complexity rules push people towards the same few substitutions.

You must still change a password promptly when you know or suspect it has been compromised. That needs an established process: who the user tells, who resets the password and who checks the account for misuse. If a system still forces regular changes, switch it off where you can and be ready to explain any exception to your assessor.

Are password managers allowed for Cyber Essentials?

Yes. v3.3 asks you to provide usable secure storage for passwords, giving a password manager or a secure locked cabinet as examples, with clear information about how and when to use it. Protect the password manager itself with a strong master password and MFA. For the few passwords people must remember, such as their device login and the master password, the NCSC recommends three random words.

What about administrator accounts and default passwords?

Administrator accounts follow the same password rules, with additions: they must be separate accounts used only for admin work, never for email or browsing, MFA should always be on, and shared admin logins break the rule that every user has unique credentials. Change default passwords on routers, firewalls, printers, NAS boxes, CCTV recorders and wifi access points before they go live; a factory login on any in-scope device breaks the secure configuration control.

How do assessors mark the password questions?

The IASME question set’s user access control section asks how you block brute-force guessing, which technical controls manage password quality, how you encourage unique passwords and whether you have a process for compromised ones. The secure configuration section asks the same about external services you host, and how devices unlock. The assessor checks each answer names an accepted method and covers every system in scope:

Cyber Essentials Plus has no separate password test, but the assessor watches users of sampled devices sign in to your cloud services, once for each sign-in service, and an MFA prompt must appear. You can preview every question on our Cyber Essentials questionnaire page.

Cyber Essentials password policy template

Cyber Essentials doesn’t require a document called a password policy, but writing one down keeps your answers consistent and gives staff one place to look. Copy the template below, replace everything in [square brackets] and delete anything that doesn’t apply; the settings it describes must also be live on your systems. For a policy covering all five controls, use our cyber security policy template.

[Organisation name] password policy. Approved by [director] on [date]. Next review: [date].

1. Scope. This policy covers every account used for [organisation name] work, including administrator accounts, accounts our IT provider uses on our behalf, and the PINs that unlock work devices.
2. Length. Passwords are at least [12] characters, or at least 8 where MFA is on [or common passwords are blocked automatically]. There is no maximum length, and special characters are not required.
3. Unique passwords. Every work account has its own password, never used anywhere else. For passwords you need to remember, use three random words.
4. Password manager. Store work passwords in [password manager], protected by MFA, and use its generator for new ones. Don’t record passwords anywhere else.
5. MFA. MFA is on for every cloud service and every other account that offers it, and always for administrator accounts.
6. Guessing protection. Accounts lock after no more than [10] failed attempts, or allow no more than 10 guesses in 5 minutes.
7. No routine changes. We don’t force regular password changes. If you think someone else knows your password, change it straight away and tell [IT lead] the same day.
8. Compromise. [IT lead] resets the password, signs the account out of all sessions and checks recent sign-in activity.
9. Administrator accounts. Admin accounts are separate, assigned to one named person and used only for admin tasks.
10. Devices and defaults. Default passwords on new devices and services are changed before use. Device PINs are at least 6 characters.

Why Sovereign Secure?

Sovereign Secure Ltd is an IASME-licensed Cyber Essentials certification body, issuing Cyber Essentials and Cyber Essentials Plus certificates. Every Cyber Essentials package includes a pre-assessment check and a support call of up to an hour, so a password setting that falls short is found before you submit.

Ready to check your password settings?

Not sure every system meets the rules? Our free Cyber Essentials readiness check takes about five minutes and includes the password and lock-out questions an assessor asks. If your settings match the tables above, choose a package on our Cyber Essentials cost page, with prices from £320 + VAT. If you would rather talk it through first, call +44 161 523 5276 and speak to an assessor.