November 2026. Many password policies date from an era of monthly changes and mandatory capital letters. That mostly produces predictable passwords. ISO 27001 (control 5.17, authentication information) asks for a controlled process, not a particular format. See also our password policy example.
What a modern policy says
Choose length over complexity: a long passphrase is stronger and easier to remember than a short string of characters. Require unique passwords per service, block known leaked passwords, and force a change only when compromise is suspected. That aligns with the guidance of many regulators and standards bodies.
The password manager as standard
Make a business password manager the norm. It solves reuse, enables controlled sharing and lets you revoke access when someone leaves. Make sure the manager itself is protected with MFA and that recovery procedures are agreed.
MFA and passwords belong together
A good password does not replace MFA. See passkeys and MFA for the next step; passkeys will largely make passwords unnecessary over time.
Technical accounts and secrets
Passwords for service integrations belong in a vault, with rotation and limited permissions, not in code or a spreadsheet. Have your developers scan for secrets in repositories.
Evidence for the auditor
The policy, the settings in your identity platform (minimum length, blocking leaked passwords), the number of users in the password manager and awareness material. More on access in access control.