Good password security isn’t just about ticking boxes. It’s about creating systems that actually work for real people doing real work. The Cyber Essentials framework gives us a practical foundation, but implementation is where most companies stumble.
Why password policies fail
Most password policies exist in a vacuum. Someone writes rules, sends an email, and expects compliance. But people work around systems that slow them down or make no sense.
The average employee manages passwords for dozens of systems. Each system has different rules. Some want 12 characters, others ban certain symbols. When faced with this chaos, people do what works: they reuse simple passwords that meet most requirements.
This isn’t user failure. It’s system design failure.
Cyber Essentials user access control requirements
The framework requires specific technical controls that address real security risks:
Account management process Every user account needs proper creation and approval procedures. This includes third-party accounts used by support services.
Unique authentication credentials Users must authenticate with unique credentials before accessing applications or devices. No shared accounts.
Account lifecycle management
Remove or disable accounts when people leave or after defined periods of inactivity.
Multi-factor authentication where available Cloud service authentication must always use MFA. Other systems should implement MFA when possible.
Separate administrative accounts Admin activities require dedicated accounts. No checking email or browsing with admin privileges.
Password-based authentication standards When using passwords, implement brute-force protection through MFA, throttling, or account lockouts after 10 failed attempts.
Technical implementation that works
Password quality controls Choose one approach: MFA for all accounts, minimum 12 characters with no maximum, or minimum 8 characters with automatic common password blocking.
Password manager deployment Provide enterprise password managers that work across all company systems. Make this standard equipment, not optional.
Smart account lockouts Lock accounts after 10 failed attempts, but use throttling first. Don’t lock people out for typos.
Remove complexity requirements Complex password rules don’t improve security. They encourage predictable patterns and discourage longer passwords.
Three random words approach Follow NCSC guidance on creating memorable but secure passwords using multiple unrelated words.
Addressing the human element
Start with leadership visibility When executives visibly use password managers and follow security practices, it signals organisational priorities.
Make secure behaviour easier
Deploy tools that reduce friction. Single sign-on, integrated password managers and streamlined MFA make security convenient.
Provide practical training Skip generic cyber security presentations. Show people how to use the actual tools you’re deploying. Demonstrate why it matters for their specific work.
Fix underlying problems If you have 15 different authentication systems that don’t work together, that’s a management problem requiring management solutions.
Cyber Essentials compliance strategy
Device unlocking credentials Require authentication before device access. Minimum 6 characters for device unlock, full password requirements if device unlock also provides system access.
Brute-force protection Implement throttling (max 10 attempts per 5 minutes) or account locking after 10 attempts. Use vendor defaults when configuration isn’t available.
Passwordless authentication options Cyber Essentials v3.2 now includes passwordless authentication guidance. Consider biometrics, security keys, one-time codes or push notifications where appropriate.
Cultural change through better systems
Measure behaviour, not just compliance Track password manager adoption rates, help desk reset requests, and security incident frequency. These indicate cultural adoption.
Turn incidents into improvements When password-related problems occur, fix the root cause in your systems, not just the immediate symptom.
Different teams need different solutions Sales teams working with external clients have different needs than internal IT staff. Tailor your approach accordingly.
Implementation roadmap
Phase 1: Foundation Deploy password managers company-wide. Set up proper user account creation and removal processes. Document administrative account separation.
Phase 2: Authentication
Implement MFA for all cloud services. Add MFA for administrative accounts and internet-accessible systems.
Phase 3: Optimisation Remove password complexity requirements. Implement common password blocking. Add passwordless options where feasible.
Beyond compliance
The goal isn’t perfect adherence to rules. It’s creating workplace cultures where security becomes natural behaviour. When people have tools that work with their daily routines rather than against them, security stops being a burden and becomes a competitive advantage.
Cyber Essentials provides the technical framework. Success comes from implementing it thoughtfully, with attention to how people actually work. The businesses that get this balance right will have both compliance and genuine security.
