# Password and Passphrase Policy Template

> Source: https://netray.co/tools/enterprise-password-and-passphrase-policy-template
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

A fill-in password policy that covers length, MFA, lockout, service accounts and shop floor shared logins, aligned with current NIST thinking.

## Category

compliance-legal

## Industry

Discrete Manufacturing

## Audience

- IT security lead
- IT manager
- Compliance officer

## Tool

**Kind:** template

**Output:** document

**Fields:**

#### Company name

**Key:** company

**Type:** text

**Default:** Acme Precision Ltd

#### Policy owner

**Key:** policy_owner

**Type:** text

**Default:** IT Security Lead

#### Version

**Key:** version

**Type:** text

**Default:** 1.0

#### Effective date

**Key:** date

**Type:** date

**Default:** 2026-11-01

#### Minimum length for user passwords

**Key:** min_len

**Type:** select

**Options:**

- 12
- 14
- 15
- 16

**Default:** 14

#### Minimum length for privileged accounts

**Key:** admin_len

**Type:** select

**Options:**

- 15
- 16
- 20

**Default:** 16

#### Failed attempts before lockout

**Key:** lockout

**Type:** select

**Options:**

- 5
- 8
- 10

**Default:** 5

#### Lockout duration in minutes

**Key:** lock_minutes

**Type:** number

**Default:** 15

#### Approved password manager

**Key:** manager

**Type:** text

**Default:** Company-approved enterprise password manager

#### Systems requiring MFA

**Key:** mfa_scope

**Type:** textarea

**Default:** Email, VPN and remote access, ERP, cloud services, administrator accounts and vendor support sessions.

**Blocks:**

#### Password and Passphrase Policy

**Body:** Organization: {{company}}
Owner: {{policy_owner}}
Version: {{version}}    Effective: {{date}}

Purpose: to set minimum requirements for authentication secrets used to access {{company}} information systems, including business applications, the ERP, remote access and plant floor systems.

#### 1. Scope

**Body:** This policy applies to employees, contractors and vendors who use or administer {{company}} systems. Where a system technically cannot meet this policy, the exception process in section 9 applies.

#### 2. Length and composition

**Body:** User passwords and passphrases must be at least {{min_len}} characters. Privileged and administrator accounts must be at least {{admin_len}} characters. Passphrases of several unrelated words are encouraged. Arbitrary composition rules (forced symbols or capital letters) are not required. New passwords are screened against lists of commonly used and previously breached passwords and rejected if found.

#### 3. Changes and expiry

**Body:** Passwords are not changed on a fixed schedule. A password must be changed promptly when there is evidence or suspicion of compromise, when a person with knowledge of a shared secret leaves, or when required after an incident. Reuse of a password across {{company}} systems and personal accounts is prohibited.

#### 4. Multi-factor authentication

**Body:** MFA is required for: {{mfa_scope}}

Phishing-resistant methods such as security keys or passkeys are preferred for administrators. SMS codes are the least preferred method and should be phased out where alternatives exist.

#### 5. Lockout and attempts

**Body:** Accounts are locked after {{lockout}} consecutive failed attempts for {{lock_minutes}} minutes, or until reset by the service desk after identity verification. Rate limiting and alerting apply to repeated failures from the same source.

#### 6. Storage and sharing

**Body:** Secrets must be stored only in {{manager}} or equivalent approved secure storage. They must never be written in emails, chat messages, shared spreadsheets or on sticky notes. Secrets must never be shared between individuals except as permitted in section 7.

#### 7. Service, shared and shop floor accounts

**Table:**

**Columns:**

- Account type
- Requirement
- Review

**Rows:**

**0:** Service accounts

**1:** Unique per application, minimum 20 characters, stored in a vault, no interactive login

**2:** Yearly and on owner change

**0:** Shared shop floor accounts (kiosks, operator stations)

**1:** Use badge or individual login where possible; if a shared account is unavoidable, restrict to the station, least privilege, no email or remote access

**2:** Quarterly

**0:** Equipment and controller defaults

**1:** Change vendor default credentials at installation; record in the vault

**2:** At commissioning

**0:** Break-glass accounts

**1:** Sealed, tested, monitored; use triggers an alert and review

**2:** Quarterly

**0:** Vendor accounts

**1:** Named, time-limited, MFA, disabled when idle

**2:** Monthly

#### 8. Responsibilities

**Body:** Users protect their credentials and report suspected compromise immediately. IT enforces technical controls, monitors failures and reviews privileged accounts. The policy owner ({{policy_owner}}) reviews this policy at least yearly.

#### 9. Exceptions and enforcement

**Body:** Exceptions require a written risk acceptance with compensating controls, an owner and an expiry date. Violations may lead to disciplinary action in line with company policy.

#### Approval

**Signatures:**

- Policy owner
- Chief information officer or equivalent
- Human resources

**Notes:** A starting point, not legal advice. The defaults follow the direction of NIST SP 800-63B (length over complexity, no forced rotation, breached password screening). Some customer contracts, regulators or legacy systems still require different rules, so check them before adopting this text as written.

## Content

**Intro:** Many password policies still demand monthly changes and odd symbols, which make passwords weaker in practice. This template reflects current guidance and adds the parts plants actually need: service accounts, shared operator logins and equipment defaults.

**Sections:**

#### How to use the template

**Body:** Choose your lengths, lockout threshold and the systems that must use MFA, then export a Word file to adapt and circulate for approval. Set longer minimums for privileged accounts, because compromise of one admin account is far more costly than a standard user. Decide your approved password manager before publishing, so people know where to store secrets. Keep the exceptions process, since some plant systems cannot meet the rules and need documented compensating controls.

**Bullets:**

- Pick realistic lengths you can enforce technically
- Name the approved password manager
- List the MFA scope explicitly

#### Why the defaults look different from older policies

**Body:** NIST SP 800-63B recommends favoring length, screening against known-breached passwords, and avoiding forced periodic changes and arbitrary composition rules, because those push users toward predictable patterns. Changes are triggered by evidence of compromise instead. MFA does more to stop account takeover than any password complexity rule, so the policy treats it as a requirement for remote access, email, ERP and privileged use.

#### Plant floor realities and common mistakes

**Body:** Operator stations, CNC controllers and legacy HMIs often use shared or default credentials. Banning them outright rarely works, so the template restricts them, reviews them and records them. A frequent mistake is publishing a policy that the directory cannot enforce. Another is forgetting service accounts, which often hold the most power and never rotate. Check your settings in Active Directory or your identity provider before you publish.

**Bullets:**

- Change vendor default credentials at commissioning
- Vault service account secrets
- Disable idle vendor accounts
- Align the written policy with what the directory enforces

**Cta:** If you want to find shared and stale accounts across your ERP and plant systems without exporting data off site, Netray can discuss a private approach. The policy template is free regardless.

**Faq:**

#### Should passwords expire every 90 days?

**Answer:** Current NIST guidance advises against routine expiry without evidence of compromise, since it encourages predictable changes. Some regulations or customer contracts still demand rotation, so check your obligations and document any exception.

#### What minimum length should we choose?

**Answer:** Twelve to sixteen characters for users is a common choice, longer for privileged accounts. Choose a number your systems can enforce and users can live with, ideally supported by a password manager and passphrases.

#### How do we handle shared operator accounts?

**Answer:** Prefer badge or individual logins. Where sharing is unavoidable, limit the account to one station, remove email and remote access, review it quarterly and log it. Document it as an exception with compensating controls.

#### Does this replace an information security policy?

**Answer:** No. It is one standard under a wider security policy set. Pair it with access control, remote access and incident response documents so the rules reference each other consistently.

## Search terms

password policy template, password policy template word, password and passphrase policy, corporate password policy example, NIST password policy template, password policy for manufacturing, shared account policy shop floor

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json