Password Policy for Mid-Market Companies: What NIST’s Current Guidelines Say to Stop Doing and Start Doing

Password Policy for Mid-Market Companies: What NIST’s Current Guidelines Say to Stop Doing and Start Doing

2026-10-22

The takeaway: If your password policy still forces quarterly changes and demands a capital letter, a number, and a symbol, it’s built on advice the U.S. National Institute of Standards and Technology (NIST) now tells its own audience not to follow. A modern password policy is shorter to write and easier to live with: require long passwords, screen them against known-compromised lists, hand everyone a business password manager, and pair passwords with multifactor authentication (MFA).

Why passwords still deserve a policy

Stolen logins remain one of attackers’ favorite tools. Verizon’s 2026 Data Breach Investigations Report (published May 19, 2026), which analyzed more than 31,000 security incidents including more than 22,000 confirmed breaches, found credential abuse was the first known way in for 13% of the roughly 20,000 breaches it analyzed for initial access (excluding errors and insider misuse). That’s down from 22% in the 2025 report, but partly because Verizon added a new “pretexting” category this year; without that change the figure would have been 16%. Exploiting software vulnerabilities, at 31%, has now overtaken stolen credentials as the top entry point. Still, the report says that counting credential abuse at any point in an attack, not just at the start, it sits on top at 39% of breaches.

Translation: credentials aren’t the only door, but they’re a door attackers walk through constantly.

What changed: NIST SP 800-63B-4

NIST finalized Special Publication 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management, on July 31, 2025. It replaces the earlier version of SP 800-63B. When this post says NIST password guidelines, this is the document it means. A fair caveat: it’s written for U.S. government systems and says it isn’t meant to constrain standards outside that purpose. But it’s a widely used public reference on passwords, and its logic travels well to private businesses.

Stop doing these five things

  1. Forcing scheduled password changes. NIST says systems “SHALL NOT require subscribers to change passwords periodically.” Force a change only when there’s evidence a password was compromised. (You may have watched Spring2026! quietly become Summer2026!.)
  2. Composition rules. Mandatory mixes of uppercase, numbers, and symbols are out. NIST says no composition rules beyond length and the blocklist check below.
  3. Security questions. NIST says not to prompt users for knowledge-based questions (“What was your first pet’s name?”) when choosing passwords. Your first pet’s name is often one social media post away.
  4. Password hints that anyone can see before logging in. Also prohibited.
  5. Blocking paste and password managers. NIST says systems shall allow password managers and autofill, and should allow pasting. If an internal app blocks paste, it’s pushing people toward short, memorable, guessable passwords.

Start doing these five things

  1. Require length. NIST requires at least 15 characters when a password is the only factor, and at least 8 when it’s used only as part of MFA. It also says systems should accept at least 64 characters, spaces included. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) tells small and medium businesses to require at least 16. If you want one number that satisfies both, use 16.
  2. Add compromised password screening. NIST requires checking new passwords against a blocklist of commonly used, expected, or compromised values: passwords from earlier breaches, dictionary words, and context-specific words like your company or app name. If your identity platform offers this, turn it on.
  3. Limit guessing. NIST caps consecutive failed attempts on an account at no more than 100 before the authenticator is disabled, and suggests options like increasing wait times to avoid locking out real users.
  4. Give everyone a business password manager. CISA’s guidance for small and medium businesses says to provide a company-wide password manager so employees remember one strong master password and let the tool generate and fill the rest. NIST notes password managers have been shown to make stronger passwords more likely.
  5. Pair passwords with MFA. NIST states plainly that “passwords are not phishing-resistant.” CISA recommends phishing-resistant MFA along with strong passwords. A good password policy reduces risk; it doesn’t replace the second factor.

A practical rollout for a mid-market company

  • Find every place a password gets set. Email and office suite, VPN, accounting or ERP, payroll, line-of-business apps, and admin consoles. Each may have its own settings.
  • Change the settings, then the document. Update length, remove rotation and complexity rules, and turn on breach screening where available. Then rewrite the written policy to match.
  • Start with the riskiest accounts. Admins, finance, and anyone who can move money or change vendor bank details go first.
  • Clean up shared accounts. Move shared logins into the password manager’s shared vaults with named owners, and rotate them when someone with access leaves.
  • Explain the “why.” Telling staff “we’re dropping the quarterly password change” earns goodwill you can spend on the password manager rollout.

Good credential hygiene isn’t glamorous, but it’s one of the easier security changes to sell to staff.

The bottom line

The modern password policy is simple: long, screened, managed, and backed by MFA. Drop the rules that annoy people without protecting anything.

If you want help turning this into a written policy, configuring it across your systems, and answering the password questions on your next cyber insurance application or customer security questionnaire, Yellow Coop’s fractional CISO and CTO services can help. Start with what we do or book a call.

Sources