# Password and authentication policy

Source: https://aestech.com.au/policy-templates/#password-and-authentication-policy
Markdown URL: https://aestech.com.au/policy-templates/password-and-authentication-policy.md

Use for ISO 27001 A.5.17, A.8.5, SOC 2 Security, and PCI DSS requirement 8 authentication controls.

Frameworks: ISO 27001, SOC 2, PCI DSS

Use this as a starting point only. Adapt it to your real scope, systems, legal obligations, customer commitments and operating process.

```text
1. Purpose
This policy defines the requirements for passwords, multi-factor authentication and other authentication methods used to access company systems, so that only authorised users can gain access.

2. Scope
This policy applies to all user accounts, administrator accounts and service accounts on company systems, including cloud platforms, email, identity providers, production systems and code repositories.

3. Policy statements
- Each user must have a unique individual account, and shared accounts are prohibited unless explicitly approved and monitored.
- Passwords must meet a minimum length of at least [12] characters and be checked against common or breached password lists where supported.
- Multi-factor authentication is required for email, identity providers, cloud consoles, production access, code repositories, finance systems and all remote and administrative access.
- Where supported, the company should prefer phishing-resistant authentication such as hardware security keys or passkeys for privileged access.
- Default and vendor-supplied credentials must be changed before a system is used.
- Credentials must not be shared, reused across personal and work accounts, or stored in plaintext.
- A company-approved password manager must be used to store work credentials.
- Accounts must lock or rate-limit after repeated failed authentication attempts.
- Service account credentials must be stored in a secret manager, restricted to required systems and rotated on a defined schedule or on compromise.

4. Roles and responsibilities
- The [Security Lead] owns authentication standards and approves exceptions.
- IT enforces password and multi-factor settings through the identity provider and system configuration.
- System owners ensure their systems meet the authentication requirements.
- Users protect their credentials and report suspected compromise.

5. Procedures
- Configure password and multi-factor policies centrally where possible.
- Enforce multi-factor authentication on all in-scope systems.
- Provide and require use of an approved password manager.
- Change all default credentials during system setup.
- Store and rotate service account secrets through a secret manager.
- Review authentication settings and exceptions periodically.

6. Evidence and records
Keep identity provider configuration, multi-factor enforcement reports, password policy settings, secret manager records, default credential change records and exception approvals.

7. Review cadence
This policy is reviewed at least annually and after material changes to identity systems.

Owner: [role]
Version: [x.y]   Approved by: [name/role]   Date: [date]
```

Full template pack: https://aestech.com.au/policy-templates/policy-pack.md