Term · 2. Authentication & Authorization
Password Policy
A password policy is the set of rules governing how passwords are created, used and managed — length, complexity, reuse, rotation and screening against known-breached passwords. Modern guidance (NIST SP 800-63B) favors long passphrases and blocklists of compromised passwords over forced periodic changes and arbitrary complexity, which pushed users toward weaker, predictable patterns. The strongest direction is to reduce password reliance entirely with MFA and passkeys.
Definition
Rules governing password creation, complexity, length, lifetime, and reuse. NIST SP 800-63B (current guidance) — minimum 8 characters (preferably ≥15), allow all printable ASCII and Unicode, no mandatory rotation, screen against breach corpora, no composition rules (uppercase/digit/symbol — these reduce entropy by predictable patterns).
- Application
- midPoint: Password policy constraints the selection and use of passwords with an aim to make them more secure.
- Sources
-
- NIST SP 800-63B Password Guidance primary source
Related terms
-
Step-Up Authentication
Pattern requiring additional authentication factors when an authenticated user attempts an action of elevated sensitivit …
-
Audit Trail
Chronological record of identity events — authentication, authorization decisions, provisioning actions, configuration c …
-
Authentication (AuthN)
Process of verifying that a principal is who they claim to be. Three classic factors: knowledge (password, PIN), possess …
-
Authentication Information
Data the principal uses to prove identity during authentication — passwords, OTP codes, biometric templates, FIDO2 crede …
-
Automated Data Classification
Machine learning-driven discovery and classification of sensitive data across structured and unstructured stores — ident …
-
Cloud Data Access Governance
Discovery, classification, and access control for sensitive data across cloud data stores (S3, Snowflake, BigQuery, Data …
Frequently asked questions
Should passwords be changed every 90 days?
Modern guidance says no. NIST SP 800-63B recommends against forced periodic rotation unless there is evidence of compromise, because it leads to weaker, incremental passwords. Change passwords when there is a reason, and screen for breached ones instead.
What makes a strong password policy today?
Generous minimum length (12 or more), allow long passphrases and all characters, block known-breached and common passwords, no mandatory arbitrary complexity, and pair with MFA. Usability is part of security.
How do passkeys change password policy?
Passkeys remove the password from the equation for supported apps, eliminating reuse and phishing risk. The strategic goal of a modern policy is to minimize where passwords are needed and move high-value access to phishing-resistant methods.