The company password and access policy
Effective date: …. Responsible: IT lead.
1. Purpose and scope
This policy covers the passwords, verification codes and access rights that The company's employees, and anyone working on its behalf, use on company accounts. Its aim is that only authorised people reach company accounts, and only as far as they need.
2. Creating passwords
Passwords are at least 14 characters long. A long passphrase is stronger than a short, complex password.
Every account has its own password; no password is used on two accounts.
Passwords do not contain names, birth dates, the company or team name, or keyboard runs (qwerty, 123456). Where possible they are made with a password generator.
3. Storing and sharing
Company passwords are kept only in the password manager the company has approved.
Passwords are not shared by e-mail, messaging apps, spreadsheets, paper or screenshots.
A shared account's password is shared only with the people who need that account, through the password manager, with the lowest permission that does the job.
4. Two-step verification
Two-step verification is on for every company account that supports it.
Verification codes are not left tied to one employee's personal phone; codes for shared accounts go to a company line or to a verification tool the team can reach.
For bank and government accounts, each employee gets their own user where possible, instead of a shared code.
5. Changing passwords
Passwords are not changed on a fixed schedule; they are changed at once on suspicion of a leak, when someone who knew them leaves, and when a password turns out to have been shared.
6. Managing access
Each employee reaches only the accounts their work needs. Temporary access is given with an end date and removed when it ends.
Who can reach which account is reviewed every three months; access no longer needed is removed.
Personal accounts (personal e-mail, personal phone) are not used as recovery details for company accounts.
7. Offboarding
A leaver's access is closed on their last working day.
Shared passwords they knew or saw are changed; two-step logins tied to them are set up again; accounts and files they own are handed over.
What was done is recorded with a date and signature.
8. Reporting incidents
An employee who suspects their password is known to someone else, an account was entered without authorisation, or an unexpected verification code arrived reports it without delay to the IT lead.
9. Responsibility and effect
Every employee is responsible for following this policy, and its owner for applying it. The policy is reviewed once a year.
Read and understood: ______________________ (name, date, signature)