Password and Passphrase Policy Template
Many password policies still demand monthly changes and odd symbols, which make passwords weaker in practice. This template reflects current guidance and adds the parts plants actually need: service accounts, shared operator logins and equipment defaults.
Fill in
Enterprise Password and Passphrase Policy Template
Password and Passphrase Policy
Organization: Acme Precision Ltd Owner: IT Security Lead Version: 1.0 Effective: 2026-11-01
Purpose: to set minimum requirements for authentication secrets used to access Acme Precision Ltd information systems, including business applications, the ERP, remote access and plant floor systems.
1. Scope
This policy applies to employees, contractors and vendors who use or administer Acme Precision Ltd systems. Where a system technically cannot meet this policy, the exception process in section 9 applies.
2. Length and composition
User passwords and passphrases must be at least 14 characters. Privileged and administrator accounts must be at least 16 characters. Passphrases of several unrelated words are encouraged. Arbitrary composition rules (forced symbols or capital letters) are not required. New passwords are screened against lists of commonly used and previously breached passwords and rejected if found.
3. Changes and expiry
Passwords are not changed on a fixed schedule. A password must be changed promptly when there is evidence or suspicion of compromise, when a person with knowledge of a shared secret leaves, or when required after an incident. Reuse of a password across Acme Precision Ltd systems and personal accounts is prohibited.
4. Multi-factor authentication
MFA is required for: Email, VPN and remote access, ERP, cloud services, administrator accounts and vendor support sessions.
Phishing-resistant methods such as security keys or passkeys are preferred for administrators. SMS codes are the least preferred method and should be phased out where alternatives exist.
5. Lockout and attempts
Accounts are locked after 5 consecutive failed attempts for 15 minutes, or until reset by the service desk after identity verification. Rate limiting and alerting apply to repeated failures from the same source.
6. Storage and sharing
Secrets must be stored only in Company-approved enterprise password manager or equivalent approved secure storage. They must never be written in emails, chat messages, shared spreadsheets or on sticky notes. Secrets must never be shared between individuals except as permitted in section 7.
7. Service, shared and shop floor accounts
| Account type | Requirement | Review |
|---|---|---|
| Service accounts | Unique per application, minimum 20 characters, stored in a vault, no interactive login | Yearly and on owner change |
| Shared shop floor accounts (kiosks, operator stations) | Use badge or individual login where possible; if a shared account is unavoidable, restrict to the station, least privilege, no email or remote access | Quarterly |
| Equipment and controller defaults | Change vendor default credentials at installation; record in the vault | At commissioning |
| Break-glass accounts | Sealed, tested, monitored; use triggers an alert and review | Quarterly |
| Vendor accounts | Named, time-limited, MFA, disabled when idle | Monthly |
8. Responsibilities
Users protect their credentials and report suspected compromise immediately. IT enforces technical controls, monitors failures and reviews privileged accounts. The policy owner (IT Security Lead) reviews this policy at least yearly.
9. Exceptions and enforcement
Exceptions require a written risk acceptance with compensating controls, an owner and an expiry date. Violations may lead to disciplinary action in line with company policy.
Approval
A starting point, not legal advice. The defaults follow the direction of NIST SP 800-63B (length over complexity, no forced rotation, breached password screening). Some customer contracts, regulators or legacy systems still require different rules, so check them before adopting this text as written.
Optional account hygiene review
Ask how a read-only review of ERP and plant accounts can surface stale, shared and over-privileged users.
Optional. The tool and every export work without this. No spam.
How to use the template
Choose your lengths, lockout threshold and the systems that must use MFA, then export a Word file to adapt and circulate for approval. Set longer minimums for privileged accounts, because compromise of one admin account is far more costly than a standard user. Decide your approved password manager before publishing, so people know where to store secrets. Keep the exceptions process, since some plant systems cannot meet the rules and need documented compensating controls.
- Pick realistic lengths you can enforce technically
- Name the approved password manager
- List the MFA scope explicitly
Why the defaults look different from older policies
NIST SP 800-63B recommends favoring length, screening against known-breached passwords, and avoiding forced periodic changes and arbitrary composition rules, because those push users toward predictable patterns. Changes are triggered by evidence of compromise instead. MFA does more to stop account takeover than any password complexity rule, so the policy treats it as a requirement for remote access, email, ERP and privileged use.
Plant floor realities and common mistakes
Operator stations, CNC controllers and legacy HMIs often use shared or default credentials. Banning them outright rarely works, so the template restricts them, reviews them and records them. A frequent mistake is publishing a policy that the directory cannot enforce. Another is forgetting service accounts, which often hold the most power and never rotate. Check your settings in Active Directory or your identity provider before you publish.
- Change vendor default credentials at commissioning
- Vault service account secrets
- Disable idle vendor accounts
- Align the written policy with what the directory enforces
Frequently Asked Questions
Should passwords expire every 90 days?
Current NIST guidance advises against routine expiry without evidence of compromise, since it encourages predictable changes. Some regulations or customer contracts still demand rotation, so check your obligations and document any exception.
What minimum length should we choose?
Twelve to sixteen characters for users is a common choice, longer for privileged accounts. Choose a number your systems can enforce and users can live with, ideally supported by a password manager and passphrases.
How do we handle shared operator accounts?
Prefer badge or individual logins. Where sharing is unavoidable, limit the account to one station, remove email and remote access, review it quarterly and log it. Document it as an exception with compensating controls.
Does this replace an information security policy?
No. It is one standard under a wider security policy set. Pair it with access control, remote access and incident response documents so the rules reference each other consistently.
If you want to find shared and stale accounts across your ERP and plant systems without exporting data off site, Netray can discuss a private approach. The policy template is free regardless.
Related Tools
Manufacturer Ransomware Readiness Assessment
A 10-question self-assessment that scores how ready a manufacturing site is to prevent, survive and recover from ransomware, including OT and ERP recovery.
Industry TemplatesManufacturing Cyber Incident Response Plan Template
A fill-in incident response plan covering roles, severity levels, containment of IT and plant floor systems, communications and recovery, exportable as a document.
Industry TemplatesOT Asset Inventory Worksheet
An editable inventory of operational technology assets with Purdue level, firmware, support status and a criticality times exposure risk score.
Safety & WorkforcePhishing Simulation Results Tracking Worksheet
Log each phishing simulation with sent, clicked, reported and credential counts. Click, report and compromise rates are calculated per campaign and overall.
More Compliance & Contracts tools
See all- Used Machinery Bill of Sale Template
- Late Delivery Liquidated Damages Notice Template
- Customer Order Cancellation and Restocking Fee Notice Template
- Contract Termination for Convenience Notice Template
- Equipment Factory Acceptance Certificate Template
- Contract Redline Issue Log Worksheet
- Contract Renewal and Notice Deadline Tracker Worksheet
- Late Delivery Liquidated Damages Calculator
- Late Delivery Liquidated Damages Exposure Calculator