Why do password policies still matter in organisations using MFA?

Why This Matters for Security Teams

Password policy still matters because MFA is a strong control, but it is not a complete control. Attackers often target the weakest adjacent path, such as password spraying, reused credentials, recovery flows, or accounts that have MFA gaps on legacy protocols. NIST’s NIST Cybersecurity Framework 2.0 still places identity and access management at the center of risk reduction, because one compromised password can remain an efficient foothold even when MFA is deployed elsewhere.

This is especially true in organisations that also manage non-human identities. NHIMG’s Top 10 NHI Issues highlights how identity sprawl, weak governance, and excessive privilege create compounding exposure. Human and non-human credentials often share the same recovery paths, directories, and authentication backends, so a weak password policy can become the first step in a broader compromise chain. In practice, many security teams discover this only after an account takeover attempt succeeds through a recovery path or a recycled password has already been abused.

How It Works in Practice

A useful password policy in an MFA environment is not about forcing endless complexity for its own sake. It is about reducing the probability that an attacker can authenticate, reset, or pivot before MFA is challenged. That means focusing on length, uniqueness, and resistance to known-bad passwords rather than outdated rules like forced periodic changes. NIST guidance in NIST SP 800-53 Rev. 5 Security and Privacy Controls supports access control and authenticators that are appropriate to the risk, which is why password policy should be treated as one layer in a broader identity program.

In practice, teams should pair MFA with controls that make password abuse materially harder:

• Block known-compromised and commonly reused passwords at creation and reset time.
• Use long passphrases instead of arbitrary complexity rules that users defeat with predictable substitutions.
• Protect password reset and account recovery flows with the same scrutiny as sign-in.
• Monitor for password spraying, credential stuffing, and impossible travel patterns across identity providers.
• Apply separate controls for privileged accounts, shared accounts, and any account tied to secrets or automation.

NHIMG research on the Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs shows why lifecycle discipline matters: if credentials are not rotated, revoked, and reviewed, attackers have more time to reuse them after compromise. Password policy supports that lifecycle by shortening the usefulness of stolen or guessed credentials and by making initial compromise harder. These controls tend to break down in large federated environments where legacy apps, service desks, and password reset exceptions create inconsistent enforcement.

Common Variations and Edge Cases

Tighter password policy often increases user friction and help desk load, so organisations have to balance resistance to attack against operational simplicity. That tradeoff is real, especially where contractors, legacy systems, or regulated workflows still depend on passwords as a primary or fallback factor.

Best practice is evolving toward risk-based handling rather than one universal password rule for every account. For most users, long and unique passwords backed by MFA are usually enough. For privileged access, shared admin consoles, and recovery paths, the bar should be higher because those accounts are disproportionately targeted. Where password-based authentication remains unavoidable, the safer approach is to make passwords harder to guess, easier to verify against breach data, and less reusable across services. NHIMG’s Ultimate Guide to NHIs — Regulatory and Audit Perspectives is a useful reminder that auditors increasingly expect organisations to show not just MFA adoption, but control over identity lifecycle and credential hygiene across the full estate.

There is no universal standard for every environment yet, but the direction is clear: password policy still matters because it limits the damage before MFA can do its job, and because some paths around MFA are still password-driven.

Related resources from NHI Mgmt Group

• Why do AiTM attacks still matter if organisations already use MFA?
• Why do smart cards still matter when organisations already use MFA?
• What do organisations get wrong about breached password risk?
• Why do phished credentials still create major risk in well-trained organisations?