Cyber Essentials password requirements in 2026: what the rules actually say
No 14-character rule. No forced expiry. No symbols-and-numbers. The 2026 requirements are shorter and kinder than most businesses expect — three acceptable ways to keep passwords strong, one way to stop guessing, and a short policy to write it down.
The rule in one sentence
Password quality must be managed by one of three technical controls — multi-factor authentication; a minimum length of 12 characters; or a minimum length of 8 characters plus automatic blocking of common passwords — and every login must be protected against guessing. That is the whole of it, across the questions that ask about it (A4.3 for your firewall, A5.3 for device defaults, A5.5 for any service you host on the internet, A7.10 and A7.11 for user accounts), plus a short device-unlock rule (A5.10). Passwords are one part of the full Cyber Essentials scheme, which covers five controls in all.
The three acceptable controls
Option 1 — Multi-factor authentication (MFA)
A code or prompt on a phone as well as the password — or a passkey instead of one. Where MFA is used, the password part must still be at least 8 characters. For cloud services MFA is not just an option here — it is required wherever the service offers it (questions A7.14 to A7.17), so for most small businesses this is the control that does the work. The free quick check asks whether it is on everywhere, along with default passwords, in about two minutes.
Option 2 — A minimum of 12 characters
No maximum length, no complexity rules. The easy way to get there is three random words. This is the natural choice for things that cannot do MFA, like a local laptop login or the router’s admin page.
Option 3 — A minimum of 8 characters plus a deny list
Shorter passwords are allowed if the system automatically blocks common and weak ones (“Password1”, the company name, and so on). This depends on the system having that feature; most small businesses find option 2 simpler.
Protection against guessing
Separately, logins must be protected against someone simply trying lots of passwords (A7.10; A5.7 for any external service you host). Any one of these satisfies it: MFA; throttling, which slows down repeated attempts to no more than 10 guesses in 5 minutes; or locking the account after no more than 10 wrong attempts. Most big cloud services throttle sign-ins and MFA covers it anyway, but check any service without MFA; for devices it is a setting.
What is not required — and is actually discouraged
- Forced expiry. You do not have to make people change passwords every 30, 60 or 90 days. The requirements advise against it, because it pushes people to weak, predictable variations.
- Complexity rules. No requirement for symbols, numbers or capitals. Length beats complexity.
- A 14-character minimum. Some older guides quote one. It is not in v3.3; the options are 12, or 8 with a deny list, or MFA.
If your current policy has any of these, updating it is a genuine improvement, not just a compliance tidy-up.
What staff should be told (A7.12)
The questionnaire asks whether you help people choose good passwords. Three things cover it: use three random words (longer and easier to remember than “P@ssw0rd!”); never reuse a work password anywhere else, so a leak elsewhere cannot open your systems; and let a password manager remember them. Add that nobody will ever be asked to change passwords on a schedule or cram in symbols, and that if they think a password has leaked they should say so straight away, no blame — speed matters far more than how it happened.
If a password is compromised (A4.4, A5.6, A7.13)
You need a way to react quickly: who changes the password, where, and what else to check. For a small business a short paragraph is enough — “the owner or office manager changes the password immediately, reviews recent sign-ins on that service, and tells the team” — provided it is true and people know it.
Writing it down
A one-page password and authentication policy is the simplest way to answer these questions consistently and to show new starters what is expected. It should say which of the three controls you use, that MFA is on for every cloud service that offers it, how you protect against guessing, that devices lock, and — explicitly — that you do not force expiry or complexity. The free password policy generator writes exactly that from three questions, and it is the same document ReadyCert drafts for its customers.
Frequently asked questions
What is the minimum password length for Cyber Essentials?
It depends which control you use. With MFA, the password element must be at least 8 characters. Without MFA, either a 12-character minimum, or an 8-character minimum with automatic blocking of common passwords. There is no 14-character rule.
Does Cyber Essentials require password expiry?
No. Forced regular password changes aren’t required and are advised against, because they push people toward weaker, reused passwords.
Does Cyber Essentials require complex passwords?
No. There is no requirement for symbols, numbers or capitals. Length and uniqueness are what the scheme asks for; three random words is the recommended approach.
Is account lockout required?
Logins must be protected against guessing by one of: MFA, throttling repeated attempts (no more than 10 guesses in 5 minutes), or locking the account after no more than 10 failed attempts. Any one of the three is enough.
Do I need a written password policy?
The questionnaire asks how you manage password quality and whether staff are encouraged to choose strong, unique passwords. A one-page policy is the simplest way to answer consistently. The free password policy generator on this site writes one.