Password and MFA policy starter

Why this matters

Here is my password and MFA policy starter you can apply this week. MFA means multi-factor authentication, a second step at sign-in. On my systems I require MFA for admin access, allow passphrases, block breached passwords, and add a short lockout after several failed attempts.

Password settings

• Set a minimum length of 12 or more characters. Longer passwords are harder to guess.
• Allow passphrases with spaces. People remember strong phrases.
• Block common and breached passwords. This stops easy attacks.
• Prevent reuse of recent passwords. Reuse keeps old risks alive.
• Do not force frequent changes without cause. Change after suspected compromise, role change, or higher access.
• Limit failed sign-in attempts and add a short lockout. This slows automated guessing.
• Use unique passwords for every system. One leak should not open others.
• Disable or rename default accounts. Defaults are well known to attackers.

MFA rules

• Require multi-factor authentication for email, admin roles, remote access, and cloud apps. These accounts carry high risk.
• Prefer an authenticator app or a hardware security key. Use text messages only as a backup.
• Issue backup codes and store them offline. This keeps access when a phone is lost.
• Set a clear MFA reset process with identity checks. This blocks social engineering.
• Review and remove unused MFA devices on a schedule. Old devices are a back door.
• Document any MFA exceptions with an end date. Temporary gaps should close fast.
• For service accounts, which are non-human logins used by software, avoid interactive login and store secrets in a safe place. Rotate them on a schedule.
• Turn on sign-in alerts where supported. Early notice helps you respond.
• Train your team to spot phishing and MFA fatigue prompts. People are your front line.

If you handle regulated data such as health information, confirm specifics with your attorney or compliance advisor.

If you want help, I can set up WAF & Firewall and review your policies under HIPAA Compliance and Hosting & Infrastructure Plans.