What it means
Passwords remain widely used, but frequent forced changes and complicated composition rules can encourage predictable behavior. Modern programs emphasize long unique passwords, password managers, compromised-password screening, and multifactor authentication.
Why it matters
A password policy must protect the complete lifecycle, including enrollment, storage, reset, recovery, and monitoring.
Practical focus
- Encourage long unique passwords and password managers
- Block known compromised values
- Protect reset and recovery flows
- Add MFA for important or exposed accounts
Common mistakes
- Relying on complexity rules alone
- Forcing routine changes without evidence of compromise
- Storing recoverable or weakly hashed passwords
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: