Password Policy for Employees and Contractors

• This document outlines the password policy for employees and contractors.
• Passwords are an important part of information security for protecting sensitive data and resources.

Password Creation Guidelines

• Passwords must be a minimum of 8 characters long.
• Passwords must contain characters from at least three of the following categories:
  • Uppercase letters (A-Z)
  • Lowercase letters (a-z)
  • Numbers (0-9)
  • Special characters (!, @, #, $, %, etc.)
• Avoid using easily guessable information such as names, birthdays, or common words.
• Passwords should not be based on dictionary words, phrases, or easily guessable patterns.

Password Management Guidelines

• Passwords must be changed at least every 100 days.
• The system will remember the last 5 passwords used, and users cannot reuse any of their last 5 passwords.
• Users should not share passwords with anyone, including colleagues, managers, or IT personnel.
• Never write down passwords or store them in an easily accessible location like sticky notes or plaintext files.

Account Lockout Policy

• After 5 consecutive failed login attempts, the account will be locked out.
• Locked accounts will remain locked for 30 minutes before the user can attempt to log in again.
• Users can unlock their accounts by contacting the IT helpdesk or following the self-service password reset procedure.

Additional Security Measures

• Multi-Factor Authentication (MFA) should be enabled wherever possible to add an extra layer of security to user accounts.
• Users should receive regular training on password security best practices and phishing awareness.
• Regular audits should be done to ensure compliance with the password policy and identify any weaknesses in password security.

Compliance and Enforcement

• All employees and contractors are required to adhere to this password policy.
• Non-compliance may result in disciplinary action, up to and including termination of employment or contract.
• IT personnel are responsible for enforcing this policy and may periodically review password settings and user compliance.

Review and Revision

• This password policy will be reviewed annually and updated as necessary to address emerging security threats or changes in technology.