Most organizations have expectations about passwords, but they are often scattered across emails, onboarding chats and habit. A short written standard puts them in one place, in words everyone can follow, with a record of who has read it.
This article is general information about documentation and planning. It is not legal, compliance or security advice. Recovery targets and technical configuration are decisions for your organization to make with qualified professionals and to record in your own documents, and which obligations apply to you varies by organization, industry and jurisdiction. The specific settings in a password standard, such as length and how accounts are confirmed, are decisions for your organization to make with qualified professionals and to record in the standard itself.
Keep it to one page
A standard people read is better than a thorough one they skip. Aim for one page with three parts: who it covers, what it says, and who to ask.
Who it covers
State the scope in a sentence or two: which people (staff, contractors, outside parties with accounts) and which accounts (company systems, shared services, anything used for company work).
What it says
Write short statements, each one a single expectation. A workable starting set:
- One person, one account. Each person uses their own account on every system. Accounts are not shared.
- A different password for each account. Passwords are not reused across systems.
- Use the approved password manager. The organization names one, by its internal name, and everyone uses it.
- Settings are set by the organization. Length and other settings are written into this standard after the organization has decided them with qualified advice.
- Shared access goes through the approved tool, never through a password passed around by message.
- Report a concern. If someone thinks a password has been seen by someone else, they say so, and the standard names who to tell.
- Leaving or changing role. Accounts are closed or changed as part of the offboarding checklist.
Who to ask
Name a role, not just a person, so the standard stays correct when people move on.
Acknowledgment
Ask each person to confirm they have read the standard, and keep a simple record:
| Field | What to write |
|---|---|
| Person | Who acknowledged it |
| Version | Which version of the standard |
| Date | When they acknowledged it |
When the standard changes, ask for acknowledgment of the new version and keep the old records.
Keeping it current
Review the standard on a cadence your organization chooses and writes down. Record each review with its date and what changed. Keep superseded versions rather than overwriting them.
What it is not
The standard records expectations and who has read them. It does not show that any account is safe, and it is not employment or legal advice.
For worksheets and checklists you can start from, see the Free Resources page on this site.