A good business password policy today asks for long, unique passwords, blocks weak and breached ones, requires multi-factor authentication (MFA) on anything important, and stops forcing staff to change passwords on a calendar. It relies on technical controls rather than on people remembering dozens of complicated strings. This guide sets out what that looks like in practice, with the figures and the sources behind them, so you can write a policy your team will follow and your IT provider can enforce.
TL;DR
- Set a minimum length of at least 10 characters for systems you run, and consider 14 for Microsoft 365, which is Microsoft’s current administrator recommendation. Do not set an artificially low maximum.
- Block common, breached and company-related passwords, and drop forced character-mix rules where you can.
- Stop routine expiry. Reset passwords when there is evidence of compromise, not on a timetable.
- Require MFA for email, remote access, finance systems and every administrator account.
- Prefer throttling to hard lockout, and watch sign-in activity for spraying and unusual locations.
Table of Contents
- Why the old rules stopped working
- A note on which rules apply in Ireland
- Password length and composition
- Block the passwords attackers try first
- Password expiry: stop the calendar resets
- MFA is the control that carries the weight
- Lockout and throttling
- Administrator and privileged accounts
- Password managers and single sign-on
- Storage: a job for your developers and suppliers
- Our perspective
- A policy you can adopt this month
- How we can help
- FAQ
- Sources
Why the old rules stopped working
Most of us grew up with the same advice: eight characters, one capital, one number, one symbol, and a change every 90 days. The result was predictable. People wrote “Summer2026!” and, three months later, “Autumn2026!”. The policy looked rigorous on paper and produced passwords an attacker could guess in a handful of tries.
The UK National Cyber Security Centre (NCSC) has taken the view that security should rely on achievable technical defences rather than perfect user behaviour. Its list of complementary controls includes single sign-on, password managers, MFA, throttling or lockout, deny lists and monitoring. Passwords remain part of the picture, but the NCSC is also clear that passwords can only do so much: even a well-implemented one cannot help once an attacker has discovered or guessed it.
That is the shift every Irish business should make. Your policy is less a list of character rules and more a small identity programme: fewer passwords, stronger sign-in for the accounts that matter, and visibility when something goes wrong.
A note on which rules apply in Ireland
Much of the best published guidance comes from the UK, namely the NCSC and the Information Commissioner’s Office (ICO). It is not Irish law. If you process personal data in Ireland, your legal obligation is to apply appropriate technical and organisational security measures under Irish and EU data protection rules, and you should take specific legal or sector advice for your own case.
What the UK material gives you is a well-tested technical benchmark. The ICO has taken enforcement action against organisations for failures that include weakly protected credentials, missing MFA, inadequate lockout and password reuse. Those are exactly the weaknesses a written password policy should close, and a documented policy is good evidence that you have thought about them.
Password length and composition
Length is the single most useful lever. The ICO’s guidance for systems you operate says to set a minimum of at least 10 characters, to allow spaces and special characters without making them mandatory, and to avoid artificial maximum lengths. Microsoft goes further for its own platform: its current recommendation to administrators is a 14-character minimum and the removal of composition requirements where possible.
You may still meet the familiar Microsoft complexity rule, three of four character classes (lowercase, uppercase, numbers and symbols), and legacy documentation that mentions an 8-character minimum. Treat those as historical defaults. Follow the current guidance for your tenant rather than copying what an older checklist says.
In practical terms, a sensible policy line reads: “Passwords must be at least 14 characters. We recommend a passphrase of three or four unrelated words. Spaces and symbols are allowed but not required.” Staff find that easier to remember than “P@ssw0rd1”, and it is harder to crack.
Do not cap the maximum
If your policy or a legacy application caps passwords at 16 or 20 characters, you are penalising the people doing the right thing. The ICO advises against artificial maximums, and the supporting guidance suggests that a cap should exist only where a documented technical limitation and a risk assessment justify it. If a line-of-business application cannot accept long passwords, record that as a known exception and compensate with MFA or network restrictions.
Block the passwords attackers try first
A deny list does more for you than a complexity rule ever did. The ICO recommends prohibiting common and breached passwords and telling users why a password was rejected, so they learn rather than guess. It also says deny lists should be updated at least yearly.
Your own list should include more than the usual suspects:
- Your company name, product names and office location (for example, “Wicklow2026” or your trading name with a number on the end).
- The names of local sports clubs, children and pets that appear on staff social media.
- Seasonal patterns, such as a month and year.
- Any password that has appeared in a known breach.
If you use Microsoft 365, Microsoft’s password protection features and self-service reset are part of the approach it suggests alongside MFA and risk-based policies. Your IT provider can switch these on and tune the custom banned list for you.
Password expiry: stop the calendar resets
Rotation is the part of the old policy most businesses are reluctant to drop, so it is worth being precise. The ICO’s advice is that password expiry should normally happen only after a breach or credible compromise. Microsoft takes the same line for Microsoft 365: for cloud-only accounts it discourages routine expiration and recommends that passwords never expire unless there is a specific reason. The reasoning is that scheduled changes produce predictable variants rather than better secrets.
What replaces rotation is a set of triggers. Force a reset when:
- A password appears in a breach feed or your sign-in monitoring flags a compromised or risky account.
- A member of staff reports a phishing click where they entered credentials.
- A device is lost or stolen and the user was signed in.
- A person with administrator or shared-account knowledge leaves the business.
If you need to disable expiry for an account in Microsoft 365, an appropriately privileged administrator can use Microsoft Graph PowerShell: connect with the User.ReadWrite.All scope, then run Update-MgUser with the -PasswordPolicies DisablePasswordExpiration parameter for that user. Scope the exception, document it, and do not confuse password expiry with account inactivity or access review. Stale accounts still need to be removed on a schedule.
MFA is the control that carries the weight
If your policy could contain only one sentence beyond length, it should be this one: all important and internet-facing accounts must use MFA. The NCSC’s guidance is to choose authentication methods that are proportionate to the risk and support the ways people naturally work. The ICO likewise recommends strong unique passwords and MFA for accounts that contain personal information.
For most small and medium businesses, the order of priority is:
- Email and Microsoft 365 or Google accounts, because they unlock password resets everywhere else.
- Remote access: VPN, remote desktop and any admin portals.
- Finance, payroll and banking.
- Cloud storage and line-of-business applications holding customer data.
- Everything else, over time.
We cover the rollout in detail in our MFA for Microsoft 365 checklist, and if you are ready to reduce passwords altogether, our guide to passwordless authentication for safer business access explains the next step. The NCSC’s own short password policy infographic opens with the same principle: reduce your reliance on passwords, consider single sign-on, hardware tokens and biometrics, and use MFA for all important accounts.
Lockout and throttling
Many policies say “lock the account after three failed attempts”. The NCSC considers throttling preferable to a hard lockout, because lockouts frustrate legitimate users and can be abused to deny service: an attacker only has to type wrong passwords against your staff to stop them working. Where you do use lockout, the NCSC suggests allowing 5 to 10 failed attempts before freezing the account.
Test the setting before you roll it out, and test it with your helpdesk and recovery procedures. This matters most for small teams, where one person may be the only administrator and an unexpected lockout of that account can stall everything. Pair the setting with alerting for password spraying, sign-ins from unexpected countries, repeated MFA failures and unusual lockouts. Spraying, where one common password is tried against many accounts, is exactly what a per-account lockout fails to catch.
Administrator and privileged accounts
The NCSC treats privileged accounts differently from ordinary ones, and so should your policy. Administrators should have separate day-to-day and privileged identities, so the account used to read email is never the one that can change the tenant. Privileged access should be protected with MFA and, where appropriate, stronger factors such as hardware tokens, and unnecessary privileges should be reviewed regularly.
A workable rule set for a small business is short:
- No one uses a Global Administrator account for email or browsing.
- Admin accounts use phishing-resistant MFA where the platform supports it.
- Admin rights are reviewed every quarter and removed when a role changes.
- Shared accounts are avoided, and where unavoidable, the credential sits in the password manager with named access.
Password managers and single sign-on
Asking staff to remember 40 unique passphrases is not a policy, it is a wish. The NCSC lists password managers and single sign-on as core controls. A business-grade password manager lets people use long random passwords they never have to type, and it makes unique-per-site passwords realistic. Single sign-on goes further by reducing the number of passwords in the first place: one well-protected identity, with MFA, opens the applications the person needs.
Your policy should say which manager is approved, that staff must not store work passwords in browsers on personal devices, and how emergency access works if someone is absent. For a wider look at securing the machines these tools run on, see our guide on how to secure business PCs without slowing work, and for the infrastructure around them, this checklist of infrastructure safeguards is a useful reference for the physical and network side.
Storage: a job for your developers and suppliers
If you build or host your own application with user logins, password storage is an engineering control, not a clause for staff. The ICO says never to store plaintext passwords, rejects MD5 and SHA-1, and recommends a password-specific salted algorithm such as bcrypt, scrypt or PBKDF2, while keeping the ability to replace an algorithm that becomes obsolete. Put a line in supplier contracts asking how credentials are stored, and ask the question when you buy software.
Our perspective
We have spent 30 years supporting Irish organisations, and the pattern we see is consistent: the businesses that struggle with passwords are rarely the ones with weak rules. They are the ones whose rules nobody can follow, so staff work around them with sticky notes, shared spreadsheets and reused credentials.
So we start with the user’s day. If a policy makes the right thing the easy thing, it holds. That means a password manager that is already installed, MFA prompts that people understand, a deny list that tells them why a choice was rejected, and a helpdesk that answers a lockout in minutes rather than hours. As a Microsoft Cloud Service Provider, we usually configure much of this directly in the client’s Microsoft 365 tenant, then watch the sign-in activity as part of proactive monitoring, so a compromised account is reset because we saw it, not because the calendar said so.
We also push back on the idea that a policy is a document to be signed once. Review it when you add a cloud application, when a key person leaves and after any incident. Treat the written policy as the record of what your systems already enforce.
— Carl
A policy you can adopt this month
Here is a compact version you can adapt. It reflects the guidance above, and you should check it against your own systems and legal advice.
| Area | Policy position | Basis |
|---|---|---|
| Minimum length | At least 10 characters for systems you run; 14 on Microsoft 365 | ICO; Microsoft |
| Maximum length | No artificial cap | ICO |
| Composition | Spaces and symbols allowed, not mandatory | ICO; Microsoft |
| Deny list | Common, breached and company-related passwords; reviewed at least yearly | ICO |
| Expiry | Only after a breach or credible compromise | ICO; Microsoft |
| MFA | All important, remote and privileged accounts | NCSC; ICO |
| Failed attempts | Throttle; if locking out, allow 5 to 10 attempts | NCSC |
| Admin accounts | Separate identities, stronger factors, regular review | NCSC |
| Monitoring | Alerts for spraying, odd locations, MFA failures | NCSC |
Roll it out in stages. Switch on MFA and the deny list first, because they give the largest gain. Remove forced expiry next and tell staff why, otherwise they will assume the policy has loosened. Then move on to lockout tuning, admin separation and the password manager.
How we can help
Writing the policy is the easy part. Enforcing it across Microsoft 365, laptops, remote access and line-of-business applications is where most small teams run out of time. Our IT security and data protection services and our managed support plans cover identity configuration, monitoring and onsite or remote help when someone is locked out. If you would like an independent view first, our security assessment and penetration testing services can test how your current setup stands up. Pricing is agreed with you after we understand your environment, so contact us through lancast.ie.
FAQ
What is the most secure practice when creating passwords?
Use long, unique passwords generated or stored by a password manager, and never reuse them across accounts. Add MFA to every important account, because a password alone can be guessed, phished or leaked. Wherever possible, reduce the number of passwords with single sign-on or passwordless methods, as the NCSC advises.
How long should a business password be?
The ICO’s guidance says at least 10 characters for systems you operate, while Microsoft’s current recommendation for Microsoft 365 administrators is 14 characters. Do not set a low maximum length. A passphrase of several unrelated words is easier to remember than a short, complex string and is usually stronger.
Should we still force staff to change passwords every 90 days?
No, not as a routine. The ICO says expiry should normally follow a breach or credible compromise, and Microsoft recommends that Microsoft 365 passwords do not expire unless there is a specific reason. Put your effort into MFA, breach detection and a fast reset process instead.
How do I disable password expiry for one user in Microsoft 365?
A suitably privileged administrator can connect to Microsoft Graph PowerShell with the User.ReadWrite.All scope and run Update-MgUser with -PasswordPolicies DisablePasswordExpiration for that user. Document the exception and review it. If you are not confident doing this, ask your IT provider to apply it.
How many failed log-in attempts should we allow before locking an account?
The NCSC prefers throttling to hard lockout. If you do lock accounts, it suggests allowing 5 to 10 failed attempts first, and testing the arrangement with your helpdesk before rollout so that legitimate users are not stranded.
Sources
- NCSC: 10 Steps to Cyber Security, identity and access management
- NCSC: Password administration for system owners
- NCSC: Password policy infographic
- ICO: Passwords in online services
- ICO: Learning from the mistakes of others, conclusion
- Microsoft Learn: Password policy recommendations for Microsoft 365