Password & Multi-Factor Authentication Policy (Template)

1. Purpose

This policy sets the minimum requirements for passwords and multi-factor authentication (MFA) across [Institution] systems to protect accounts, data and services.

2. Scope

All staff, students, contractors and systems that authenticate users, including email, learning platforms, examination systems, administrative portals and cloud accounts.

3. Password requirements

• Minimum length: 12 characters for standard users, 16 characters for administrators.
• Passphrases (several unrelated words) are encouraged; complexity rules (symbols, numbers) are not mandated.
• Passwords must not be reused across institution and personal accounts.
• Passwords are checked against known-breached password lists where the system supports it.
• Passwords are changed when there is evidence of compromise — not on a fixed schedule.

4. Multi-factor authentication

• MFA is required for administrators, finance, HR, examination controllers and anyone with remote access.
• MFA is strongly recommended for all other users and will become mandatory on [date].
• Preferred methods: authenticator apps or hardware keys. SMS is permitted only as a fallback.

5. Account security

• Accounts are locked after 10 failed attempts for 15 minutes.
• Shared accounts are prohibited; service accounts have a named owner and documented purpose.
• Leavers' access is removed within one working day.

6. Responsibilities

• Users keep credentials private and report suspected compromise immediately.
• IT enforces this policy technically where possible and reviews exceptions quarterly.
• Management approves exceptions in writing.

7. Review

This policy is reviewed annually or after a significant incident. Version: 1.0 · Owner: [Name] · Approved: [Date]