How to get password policies right
The gap between knowing this and actually doing it is where most teams lose ground. The short answer to password policies is that it is mostly a sequence of small decisions, not one big one.
Security is a maintenance habit rather than a purchase, which is why it drifts. The failure mode is not doing it wrong, it is doing it once and assuming it stays done.
What is actually at stake
Length beats complexity rules. It is worth being explicit about, because assumptions differ quietly. Most teams find the first pass takes an afternoon and the maintenance takes minutes a month.
The steps
- Establish what you have today before changing anything
- Forced rotation makes passwords worse, not better
- Check credentials against known breach lists
- Write down the decision so the next person does not re-litigate it
Check credentials against known breach lists. The teams that handle this well are rarely the ones with the biggest budgets. The failure mode is not doing it wrong, it is doing it once and assuming it stays done.
Making it stick
The short version
The realistic threat for most small businesses is automated and opportunistic, not targeted. Three things worth confirming about password policies before you move on:
- Someone can say what the current setup is without going to look
- Forced rotation makes passwords worse, not better — and you know whether that is true here
- There is a way to tell whether the last change to this helped
If any of that sounds like a description of your current setup, it is fixable.