In short: Cyber Essentials password requirements say passwords must be protected from guessing by MFA, throttling or lockout after no more than 10 attempts. Quality must be enforced by MFA, a 12-character minimum, or an 8-character minimum with a deny list, never with a maximum length. Do not force regular expiry or complexity rules.
Where the password rules sit
Password rules belong to the User Access Control control, with a related rule for device unlocking under Secure Configuration. Every user account must require authentication. Where that authentication uses a password, the protections below apply. They also apply to the admin passwords on firewalls and routers covered by the firewall requirements.
The password rules at a glance
| Requirement | What satisfies it |
|---|---|
| Brute-force protection (at least one) | MFA; or throttling that allows no more than 10 guesses in 5 minutes; or lockout after no more than 10 failed attempts |
| Password quality (at least one) | MFA; or a minimum of 12 characters; or a minimum of 8 characters plus automatic blocking of common passwords with a deny list |
| Maximum length | None allowed in any of the options |
| Password element of MFA | At least 8 characters, no maximum |
| Device unlock-only PIN or password | At least 6 characters |
| Expiry | Do not force regular password changes |
| Complexity | Do not enforce complexity rules |
| Compromise | Have a process to change passwords promptly if one is known or suspected to be compromised |
The same rules apply whether the password protects a user account, a cloud service or a firewall admin page, so it is worth setting them once, centrally, in your directory and cloud services.
Protecting against guessing
Automated tools can try thousands of passwords a minute. Cyber Essentials requires at least one technical defence:
- MFA, so a guessed password alone is not enough to sign in
- Throttling, where the wait between attempts grows after each failure, allowing no more than 10 guesses in 5 minutes
- Lockout after no more than 10 unsuccessful attempts
Cloud services such as Microsoft 365 apply their own smart lockout, but MFA is the strongest option, and for cloud services it is mandatory anyway. See Cyber Essentials MFA.
Password quality: length, deny lists and MFA
You must use a technical control, not just a written policy, to manage password quality. The three accepted routes:
- MFA on the account
- A minimum length of 12 characters, with no maximum
- A minimum length of 8 characters, with no maximum, plus automatic blocking of common passwords using a deny list
Microsoft Entra ID, for example, includes a global banned password list that can serve as a deny list, and with the appropriate licence you can add a custom list of words specific to your organisation. Whatever route you choose, do not cap the length: long passphrases must be allowed.
Helping people choose good passwords
The requirements also expect you to support users rather than burden them:
- Teach people to avoid common passwords, keyboard patterns, pet names and passwords reused from other sites, including using the generator in a password manager
- Encourage longer passwords made from at least three words, in line with the NCSC's three random words advice
- Provide somewhere secure to store passwords, such as a password manager or a locked cabinet, with clear guidance on when to use it
- Do not force regular expiry: frequent changes push people towards predictable patterns
- Do not enforce complexity rules such as mandatory symbols, which add little and frustrate users
Security awareness training is the natural way to deliver this, especially for smaller teams; see training for small businesses.
Device PINs and MFA passwords
Two related length rules often cause confusion. A PIN or password that only unlocks a device, such as a phone, needs at least 6 characters, with the same throttling or lockout protection. If the same credential is also used to sign in to services, the full password rules above apply instead.
Where a password is one factor in MFA, it must be at least 8 characters with no maximum length. Phishing-resistant passwordless methods such as passkeys avoid the password problem altogether; Cisco Duo Passwordless is one example.
When a password is compromised, and how we help
You need an established process for changing passwords promptly when you know or suspect an account has been compromised: who users tell, who resets the password, and how you check for misuse. Dark web monitoring can alert you when company credentials appear in breach data.
We configure lockout, length and deny-list policies in your directory and cloud services, remove old expiry and complexity rules, roll out password managers and MFA, and document the compromise process. Contact us to bring your password policy in line with v3.3, or return to the Cyber Essentials requirements overview.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the minimum password length for Cyber Essentials?
It depends on the other controls in place. Without MFA, passwords need at least 12 characters, or at least 8 characters with a deny list blocking common passwords. With MFA, the password element must be at least 8 characters. There is never a maximum length.
Does Cyber Essentials require password expiry?
No. The requirements say you should not enforce regular password expiry. Passwords should be changed promptly only when you know or suspect they have been compromised.
Do Cyber Essentials passwords need special characters?
No. You should not enforce complexity requirements such as mandatory symbols or mixed case. Length, deny lists and MFA are the accepted ways to manage password quality.
Are three random words acceptable for Cyber Essentials?
Yes. The requirements encourage passwords built from at least three words, in line with the NCSC's three random words guidance, as long as they meet the length rule that applies to the account.
Is a 4-digit phone PIN allowed for Cyber Essentials?
No. A PIN or password that only unlocks a device must be at least 6 characters, and the device must throttle guesses or lock after no more than 10 failed attempts.