How should organisations modernise password policy without weakening identity security?

Why This Matters for Security Teams

Modern password policy is not really about making passwords harder to guess. It is about reducing the value of passwords as a standalone authenticator while preserving access for lower-risk users and legacy systems. That distinction matters because credential stuffing, phishing, and password reuse still drive account takeover, but complexity rules do little against those attacks. NIST’s Cybersecurity Framework 2.0 and the NHI guidance in the Ultimate Guide to NHIs both point toward stronger identity assurance, not longer memorisation burdens.

The real question is whether the organisation can verify identity at the right assurance level for the risk of the action being taken. For privileged users and sensitive systems, that usually means phishing-resistant authentication, step-up checks, and tighter session controls. For less sensitive access, it means long passphrases, breach screening, and fewer prompts that push users into unsafe workarounds. In practice, many security teams encounter password policy failures only after a reused credential or leaked secret has already been used for access, rather than through intentional testing of identity assurance.

How It Works in Practice

A modern policy starts by separating passwords from stronger authenticators instead of treating them as equal. The password becomes one layer, not the whole control. That means setting minimum length over complexity, rejecting known-compromised passwords, and pairing the login flow with MFA or phishing-resistant methods where the risk justifies it. Guidance from NIST and the broader identity community has shifted away from periodic forced resets unless compromise is suspected, because arbitrary expiry often increases reuse and support burden without materially improving security.

For higher-risk access, organisations should use assurance-based design. That means deciding at runtime what level of authentication is required based on the user, device, network context, and the action being attempted. Passwords may still exist, but they should not be the deciding factor for access to admin consoles, production systems, or sensitive data. For machine access, the model changes further: service identities should not rely on human-style passwords at all. NHIMG’s 52 NHI Breaches Analysis and the Lifecycle Processes for Managing NHIs show why rotation, revocation, and short-lived credentials matter more than memorability in modern estates.

• Use long passphrases with breach screening instead of composition rules.
• Reserve passwords for lower-risk access and require phishing-resistant MFA for privileged users.
• Remove periodic reset requirements unless there is evidence of compromise.
• Apply step-up authentication for sensitive actions, not just logins.
• Track recovery flows, because password reset is often the weakest path in the identity stack.

This approach aligns with the spirit of zero trust and modern identity governance, but it only works when applications, help desks, and legacy directories can all enforce the same policy consistently. These controls tend to break down when old systems still require shared accounts or cannot support modern authenticators, because the exception path becomes the real attack path.

Common Variations and Edge Cases

Tighter password policy often increases rollout and support overhead, requiring organisations to balance stronger assurance against user friction and application compatibility. That tradeoff is real, especially in mixed environments with legacy VPNs, on-prem applications, and externally managed vendors. Current guidance suggests treating those exceptions as temporary risk decisions rather than permanent policy.

One common edge case is recovery. Even a strong password policy fails if self-service reset relies on weak email access, insecure help-desk verification, or recovery questions that attackers can research. Another is shared and break-glass accounts, which should be tightly controlled, logged, and excluded from normal user policy only when there is a documented operational need. Organisations also need to recognise that password policy alone does not address secret exposure in code, CI/CD, or configuration stores. NHIMG’s Regulatory and Audit Perspectives notes that identity governance increasingly spans both human and non-human access, so password reform should be part of a wider control update, not a standalone event. The strongest programmes modernise passwords while also reducing password dependence across privileged and machine access.

Related resources from NHI Mgmt Group

• How should organisations reduce password-related lockouts without weakening security?
• How should security teams govern multiple high-assurance credentials without fragmenting policy?
• How should security teams use AI in identity governance without weakening controls?
• How should security teams implement passwordless authentication without weakening identity assurance?