Password policy generator for Cyber Essentials
Three questions about how your business handles passwords, and you get a one-page Password & Authentication Policy written to the 2026 Cyber Essentials rules — the same document ReadyCert drafts for its customers. Copy it, download it, or print it.
Generate your policy
The .md file opens in Word, Google Docs and Notion. Nothing leaves your browser.
Password & Authentication Policy — Your company
Adopted today. Reviewed when our tools or the Cyber Essentials scheme change.
How we keep passwords strong. At Your company, work passwords meet the Cyber Essentials requirement by using two-factor login, and requiring passwords of at least 12 characters.
Two-factor login. We switch on two-factor login (a code or prompt on your phone, as well as your password) on every cloud service that offers it — for every user, including administrators. Two-factor login is currently on for all our cloud services.
Protection against password guessing. Two-factor login is our main protection against password guessing.
Device locks. Our computers, phones and tablets need a fingerprint, face, password or PIN to unlock. A PIN or password that only unlocks a device is at least 6 characters; where the device login also opens our work accounts, the password rules above apply to it.
What we don't do — on purpose. We don't force regular password changes, and we don't require symbols-and-numbers complexity rules. Cyber Essentials advises against both, because they push people toward weaker, reused passwords.
What the 2026 rules actually say about passwords
The Cyber Essentials requirements for passwords are shorter and kinder than most people expect. Password quality has to be managed by one of three technical controls: two-factor login (MFA); a minimum length of 12 characters with no maximum; or a minimum of 8 characters with no maximum plus automatic blocking of common passwords. Where MFA is used, the password part of it must still be at least 8 characters.
Separately, every login needs protection against someone simply guessing: MFA, slowing down repeated attempts, or locking the account after no more than ten wrong tries. And two things many businesses still do are not required — in fact the scheme advises against them: forcing people to change passwords on a schedule, and demanding symbols-and-numbers complexity. Both push people toward weak, reused passwords written on a sticky note.
Why a one-page policy is enough
The questionnaire does not ask for a policy document as such. It asks how you manage password quality, how you protect against brute-force guessing, and whether staff are encouraged to use strong, unique passwords. A short written policy is simply the cleanest way to answer those consistently, and to show new starters what is expected on day one. For a business of five to fifty people, a page is normal; a ten-page document nobody reads is worse than a paragraph everyone has seen.
What to do with it
- Check it is true. The policy describes what you actually do. If it says two-factor login is on everywhere and it is not, fix the setting before you adopt the policy — an assessor reads your answers, not your intentions.
- Adopt it. Save the file somewhere the team can find it, note the date, and mention it in your onboarding.
- Tell the team the three-random-words rule. “CorrectHorseBattery” beats “P@ssw0rd!” — longer, and easier to remember. Never reuse a work password anywhere else, and let a password manager remember them.
- Revisit it when things change. A new tool, a new scheme version, or a change to how you log in.
MFA is the control that actually decides most assessments — see the MFA guide for which accounts need it and the ones businesses forget.
Frequently asked questions
What are the Cyber Essentials password requirements in 2026?
Password quality must be managed by one of three technical controls: multi-factor authentication (MFA); a minimum password length of 12 characters with no maximum; or a minimum of 8 characters with no maximum plus automatic blocking of common passwords. You also need protection against guessing — MFA, throttling (no more than 10 guesses in 5 minutes), or locking accounts after no more than 10 failed attempts.
Does Cyber Essentials require passwords to expire or contain symbols?
No. Forced password expiry and complexity rules (symbols, numbers, capitals) aren’t part of the requirements. The scheme advises against both because they push people toward weaker, reused passwords. Long, unique passwords — three random words — are the recommended approach.
Is there a 14-character password rule?
No. The options in the v3.3 requirements are MFA, a 12-character minimum, or an 8-character minimum with a deny list. Some older guides still quote other numbers.
Do I need a written password policy for Cyber Essentials?
The questionnaire asks how you manage password quality and whether staff are encouraged to use strong, unique passwords. A short written policy is the simplest way to answer those questions consistently and to show staff what is expected. It does not need to be long — one page is normal for a small business.
Where does my company name go?
Only into the text on this page, in your browser. It is not stored by ReadyCert or sent anywhere. Downloading or copying the policy is entirely local.