# What makes a good company password policy?

Length, uniqueness and multi-factor authentication, rather than complexity rules and forced monthly changes. NIST's Digital Identity Guidelines (SP 800-63B) favour long passwords, checking new passwords against lists of known-breached ones, and changing a password when there is evidence that it was compromised rather than on a fixed schedule, because forced periodic changes push people towards predictable patterns. In practice: a minimum length that allows passphrases, no reuse across systems, a password manager for everyone, blocking of breached and common passwords, lockout or slowdown after repeated failures, and MFA on everything that faces the internet. Admin and service accounts deserve longer, randomly generated passwords stored in a vault. Explain the reasons to staff; a policy people understand is followed more. NetSenX does not enforce passwords. On the network it flags repeated login attempts against monitored hosts as brute force, on every plan, which shows when someone is guessing.

FAQ: [Zero trust, identity and segmentation](https://netsenx.com/en/faq/zero-trust) · https://netsenx.com/en/faq/what-makes-a-good-company-password-policy

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/what-is-ndr

## Related questions

- [What is single sign-on, and does it improve security?](https://netsenx.com/en/faq/what-is-single-sign-on-and-does-it-improve-security)
- [How do we monitor an external accountant's remote access to our PCs?](https://netsenx.com/en/faq/how-to-monitor-an-external-accountants-remote-access)
- [What happens if our outsourced IT provider or bookkeeper is hacked?](https://netsenx.com/en/faq/what-happens-if-our-outsourced-it-or-bookkeeper-is-hacked)
- [How do I find old remote-access tools that suppliers left on our servers?](https://netsenx.com/en/faq/how-to-find-old-remote-access-tools-suppliers-left-on-servers)
- [How do we control and monitor third-party vendor access to our network?](https://netsenx.com/en/faq/how-to-monitor-third-party-vendor-access)