TOOLBOX · DOWNLOAD
Passwordpolicy as atemplate.
Many password policies still require special characters and a change every 90 days. The current NIST SP 800-63B-4 of July 2025 prohibits both for authentication systems and relies on length, blocklists, and limited failed attempts; in IT-Grundschutz, the BSI advises against purely time-based changes. This template translates the requirements into policy text with placeholders, compares old and new rules with citations, and guides you through the implementation in Microsoft Entra ID.
Free PDF · Template
Password Policy: Template Based on NIST and BSI
- Topic
- Security Basics
- Format
- PDF, A4
- Length
- 11 pages
- Size
- 135 KB
- Updated
- Oct 25, 2026
- Sources
- 12
- Usage
- Adaptation for your own use permitted; redistribute unchanged
WHO IT IS FOR
Who This
Is for.
Policy text with placeholders, old and new rules with citations, and a checklist for Microsoft Entra ID, backed by NIST SP 800-63B-4, BSI ORP.4, and Microsoft Learn.
- Executive management of small and medium-sized companies that want to issue a binding password policy
- IT management and information security officers who bring existing rules up to the NIST and BSI standard
- IT service providers that set up password rules and Microsoft Entra ID for their customers
9 SECTIONS
What Is
Inside.
- 01
What NIST and BSI require today
The new basic rules at a glance and how binding the sources are for companies in Austria.
- 02
Old rule, new rule
Nine common password rules and what replaces them under NIST SP 800-63B-4 and BSI ORP.4.
- 03
Where multifactor authentication is mandatory
NISG 2026 for NIS2 entities and Microsoft for administrative access; the BSI recommends it (SHOULD) for administrators.
- 04
Template: password policy to adapt
Model text with 15 clauses for all accounts, special accounts, and IT systems, plus the approval form to fill in.
- 05
Implementation in Microsoft Entra ID
What is fixed, what you can configure, and which license you need for it.
- 06
Requirements for authentication systems and your own applications
What systems check, how they limit failed attempts, and how they store passwords, according to NIST and BSI.
- 07
Common mistakes during the transition
Where new password rules fail in practice and how to avoid it.
- 08
Outlook: passkeys instead of passwords
Why passkeys are phishing-resistant and what Microsoft Entra ID already offers for them today.
- 09
Four steps to the new policy
From taking stock through approval and technology to instruction and annual review.
EXCERPT
Old rule, new rule
| Common until now | New | Citation |
|---|---|---|
| At least 8 characters with uppercase and lowercase letters, a digit, and a special character | Length instead of character types: at least 15 characters, at least 8 only in combination with MFA; no other composition rules | NIST 3.1.1.2; Microsoft recommends at least 14 characters for Microsoft 365 |
| Change every 30, 60, or 90 days | No change after a set period; mandatory change on suspicion or evidence of compromise | NIST 3.1.1.2; ORP.4.A8, ORP.4.A23 |
| Maximum length of 12 or 16 characters, spaces prohibited | Allow at least 64 characters, all printable characters, and spaces; check the full length | NIST 3.1.1.2; ORP.4.A23 |
| No check against known passwords | Blocklist of common, expected, and compromised passwords; rejection with an explanation | NIST 3.1.1.2; ORP.4.A8 |
| Pasting blocked, password managers discouraged | Allow password managers and autofill, permit pasting | NIST 3.1.1.2; ORP.4.A8 (review use) |
| Security question and password hint for resets | No security questions, no hints visible without signing in; secure reset procedure | NIST 3.1.1.2; ORP.4.A11 |
| Unlimited sign-in attempts | Limit failed attempts: increasing delay and lockout after a defined number, at most 100 | NIST 3.2.2; ORP.4.A13 |
| Password as the only protection, even for administrators | MFA, at least for administrators; offer a phishing-resistant method | ORP.4.A10, ORP.4.A21; NIST 2.2.2; § 32 para. 4 lit. j NISG 2026 |
| Passwords stored in plain text or with reversible encryption | Stored salted and with a password hashing scheme | NIST 3.1.1.2; ORP.4.A12, ORP.4.A23 |
NIS2 entities: Under annex point 11.6.2 of Implementing Regulation (EU) 2024/2690, which § 2 NISV 2026 declares applicable, authentication credentials must be changed at the outset, at predefined intervals, and on suspicion (lit. c); after a defined number of unsuccessful sign-in attempts, a reset of the authentication credentials and a lockout must be required (lit. d); inactive sessions must be terminated (lit. e); and separate credentials must be used for privileged accounts (lit. f). You set the interval yourself and justify it with the risk analysis; the annex does not specify a minimum value.
SOURCES
Supported
by Sources.
- NIST SP 800-63B-4: Digital Identity Guidelines, Authentication and Authenticator Management (final version, July 2025) (opens in a new tab)Abstract, Notations, sections 2.2.2, 2.3.2, 3.1.1, 3.1.1.2, 3.2.2, 3.2.5, Appendix B; accessed October 25, 2026
- BSI IT-Grundschutz Compendium, Edition 2023: module ORP.4 Identity and Access Management (opens in a new tab)Chapter 3 with ORP.4.A1, A8 to A14, A19, A21, A23, and A24; accessed October 25, 2026
- BSI: Creating secure passwords (opens in a new tab)Password check, length and complexity, password managers; accessed October 25, 2026
- NISG 2026, § 32 Cybersecurity risk management measures, current daily version in the RIS (opens in a new tab)§ 32 paras. 1 and 3, para. 4 lit. j, and para. 5, valid from October 1, 2026; accessed October 25, 2026
- NISV 2026, BGBl. II No. 290/2026, authentic promulgation in the RIS (opens in a new tab)§§ 2, 4 to 7, and 9, promulgated on October 1, 2026, accessed October 25, 2026
- Implementing Regulation (EU) 2024/2690, annex points 11.6 and 11.7 (authentication) (opens in a new tab)Applicable to all essential and important entities under § 2 NISV 2026
- Microsoft Learn: Password policy recommendations for Microsoft 365 (opens in a new tab)Introduction, password policies for administrators and users; accessed October 25, 2026
- Microsoft Learn: Eliminate bad passwords using Microsoft Entra Password Protection (opens in a new tab)Global and custom banned password lists, evaluation, hybrid scenarios, licenses; accessed October 25, 2026
- Microsoft Learn: Password policies and account restrictions in Microsoft Entra ID (opens in a new tab)Microsoft Entra password policies, expiration policies; accessed October 25, 2026
- Microsoft Learn: Protect user accounts from attacks with Microsoft Entra smart lockout (opens in a new tab)How it works, pass-through authentication, managing lockout values; accessed October 25, 2026
- Microsoft Learn: Mandatory multifactor authentication for Azure and admin portals (opens in a new tab)Enforcement phases 1 and 2, accounts, preparation, frequently asked questions; accessed October 25, 2026
- Microsoft Learn: Enable passkeys (FIDO2) in Microsoft Entra ID (opens in a new tab)Passkey profiles, synced passkeys, authentication strength, known issues; accessed October 25, 2026
This template must be adapted to your company, your systems, and your protection requirements and does not replace legal advice. The cited standards and vendor information in their current version are authoritative, and for entities under the NISG 2026, the statutory text in its current version. Microsoft features, names, and licenses may change.
TOOLBOX
Explore
Further.
- Kostenlos
NIS2 applicability check (German)
Am I affected? In 3 minutes
Check Now Password manager
How password managers store credentials in encrypted form, generate strong passwords, and enable sharing of access within the company.
Learn MoreMultifactor authentication
How MFA confirms a sign-in with at least two independent factors and which factors exist.
Learn MorePasskey
Passwordless sign-in with key pairs based on FIDO2 and WebAuthn, unlocked by fingerprint, face, or PIN.
Learn More
SECURITY BASICS
More on
This Topic.
- PDF
IT Security Policy
Model text with placeholders for the information security policy and eight basic rules for all employees, aligned with BSI IT-Grundschutz, the NISG 2026, and the NISV 2026.
View - PDF
Phishing Cheat Sheet
Warning signs with ways to check them, CEO fraud, QR codes, calls and MFA requests, immediate steps after a click, and the reporting channels in Austria: compact, ready to share and post.
View - PDF
Patch Management Checklist
Updates by risk instead of by calendar: inventory, prioritization by exploited vulnerabilities, deadlines per risk level, roles, exceptions and evidence. Based on BSI, NIST, CISA and the NISV 2026.
View
YOUR NEXT STEP
From Paper
to Practice.
We review with you what is already implemented in your environment and put the rest into practice: as a project with EXPERTS or as ongoing operations with GRID.