Cyber Essentials password policy: what a small business needs to put in place

The Cyber Essentials Requirements for IT Infrastructure v3 do not set one password length for every case. For any password-based account you need two things: protection against brute-force guessing, and a technical control that stops weak passwords being chosen. The password-quality control can be MFA, or a minimum of 12 characters with no maximum length, or a minimum of 8 characters with no maximum plus automatic blocking of common passwords.

The same document expects MFA on administrator accounts and on any account reachable from the internet, such as Microsoft 365 or Google Workspace mailboxes and cloud admin consoles. Where MFA is in place, the password behind it must still be at least 8 characters with no maximum. I cannot confirm the effective date of the v3 document from the source details, so check the scheme version your assessor is using before you finalise anything.

Brute-force protection means an attacker cannot simply try thousands of guesses against a login. The requirements accept three approaches: MFA, increasing delays between attempts so that no more than 10 guesses are possible in 5 minutes, or device lockout after no more than 10 failed attempts. You need one of these on every password-based account in scope.

For a Windows laptop, this is usually the account lockout or sign-in failure setting in Intune, Group Policy or the local device policy. For cloud services, Microsoft 365 and Google Workspace apply throttling and smart lockout by default, but confirm that the setting is active on your tenant and write down where you checked. Assessors ask how the control is enforced, so a screenshot of the configured policy is better evidence than a sentence in a policy document.

For most small businesses the simplest route to compliance is to rely on MFA for anything important and set a 12 character minimum on the rest. A 12 character minimum with no maximum satisfies the password-quality requirement without needing a blocklist. The alternative, 8 characters plus automatic blocking of common passwords, works if your platform has a built-in blocklist you can switch on.

Do not set a maximum length, and do not impose composition rules that push people towards predictable patterns such as a capital first letter and a trailing number. The ICO guidance for online services suggests a minimum of 10 characters, no maximum, and blocking common or breached passwords. That is advice for systems you build for customers and does not replace the Cyber Essentials threshold, but it is a sensible reference if your business handles personal data.

Account separation reduces the damage when one credential is stolen. Give administrators a standard account for daily work such as email and browsing, and a separate admin account used only when they need to change settings. Do not let a director or office manager run with admin rights on their everyday login because it is convenient.

Each person needs their own login to every system. Shared mailboxes and shared logins for accounting software or social media are common in small firms, and they remove any record of who did what. Where several people need access, use delegation, shared mailbox permissions or the tool's own user-invite feature. Replace every default password on routers, printers, cameras and network storage at setup, because defaults are published in manufacturer manuals and attackers try them first.

NCSC advises letting staff store passwords in a password manager, because unique long passwords are not realistic to memorise across dozens of work accounts. Choose a business plan from a reputable vendor, protect the vault with MFA, and show staff how to generate and save passwords on the first day. A manager also makes it easier to stop password reuse, which is the habit that turns one breach into several.

NCSC also advises against automatic password expiry. Forced changes every 60 or 90 days push people to make small, predictable edits to the old password. Instead, require a change when you suspect compromise, such as a phishing report, a lost laptop or a breach notification, and make sure staff know how to reset a password themselves without waiting for the owner.

A password policy for a 5 to 50 person business can fit on one page. State the minimum length, that MFA is mandatory for email, admin and internet-facing accounts, that passwords are unique and may be stored in the approved manager, that sharing is not allowed where delegation exists, and that a suspected compromise triggers an immediate change and a report to the named owner.

Keep evidence alongside the document: the screenshot of the lockout or throttling setting, the MFA enforcement report from your identity provider, and a list of admin accounts with the person responsible for each. Review the list when staff join or leave. This is the material that makes the self-assessment answers defensible if an assessor questions them.