A password policy that matches modern guidance
By Sam Rivera, Founder, SentinelPanda · June 19, 2026 · 1 min read · Compliance
Forced 90-day rotations and complexity gymnastics are out. Length, screening against breached passwords, and MFA are in.
What changed
Modern guidance (notably NIST SP 800-63B) reversed decades of habit: long passphrases beat forced symbol-soup, mandatory periodic rotation does more harm than good (it drives predictable patterns), and the highest-value move is screening new passwords against known-breached lists. Many compliance frameworks have followed — PCI DSS 4.0 raised minimum length and de-emphasised blind rotation.
What to require
- A reasonable minimum length (longer is better) and allow long passphrases and the full character set, including spaces.
- Screen new/changed passwords against a breached-password corpus and reject matches.
- Drop calendar-based rotation; rotate on indication of compromise instead.
MFA and SSO matter more
The honest truth is that a second factor does more for account security than any password rule. Anchor authentication on SSO with MFA enforced, and the password becomes one factor of several rather than the whole defence. Spend effort there before perfecting password complexity.
Align the policy to reality
Write the policy to match modern guidance and what your identity provider actually enforces, so the document and the system agree. SentinelPanda tracks the authentication controls — length, breach screening, MFA coverage — as evidence against the relevant framework requirements.