In short: The NIST SP 800-63B guidelines require long passwords (at least 15 characters if they are the only factor) and prohibit mandatory composition rules and forced periodic changes. They recommend blocklists, password managers and phishing-resistant authentication. In a business, two-factor authentication on email, admin panels and management software is the measure that carries the most weight.
A cyber attack rarely begins with a genius breaking into a system. More often it begins with a password that was found, guessed or stolen. That is why the rules on how logins are chosen and protected matter more than almost any other measure. The advice below is based on the guidelines from NIST (the US institute that publishes reference standards), in version SP 800-63B-4.
The password rules that have changed
For years we were taught to use capitals, numbers and symbols and to change our passwords every ninety days. The current guidelines say otherwise:
- Length first. At least 15 characters if the password is the only factor. At least 8 if a second factor is added. Systems should accept up to at least 64 characters, spaces included.
- No mandatory composition rules. Capitals, numbers and symbols are not imposed.
- No forced periodic changes. You change a password when there is a sign it has been compromised.
- Checks against lists of known passwords. A password that has already appeared in a data breach, or is far too common, should be rejected.
- Pasting and password managers allowed. Blocking paste pushes people towards weaker passwords.
The practical result is a long, unique passphrase for each service, which nobody knows by heart and a password manager keeps safe.
The password manager
A program that generates and stores a different password for each account. You only remember the master password, which is long. It is protected with a second factor. For businesses there are versions with sharing between colleagues and permissions: shared credentials (hosting, social media, management software) no longer circulate by email or in spreadsheets.
Two-factor authentication
On top of the password you need a second proof: something you have (a phone, a key) or something you are (a fingerprint). A stolen password on its own is no longer enough. Where to switch it on first:
- Company email: every other password can be reset from there.
- Admin panels: hosting, domain, DNS, Cloudflare and the like.
- Website administration: WordPress, WooCommerce, Shopify, management software.
- Payment services and banking.
- Social media and advertising tools.
- Code repositories and development tools.
Which second factor to choose
- SMS: better than nothing. It can be intercepted or hijacked through SIM swapping.
- Authenticator apps (time-based codes): more robust than SMS.
- Physical security keys and passkeys (WebAuthn/FIDO2 standard): phishing-resistant because they are bound to the genuine site. NIST specifies that codes typed in by hand are not phishing-resistant.
Access for staff and contractors
- One account per person. Never shared passwords for different users: you can't tell who did what.
- Few privileges. Everyone accesses what their job requires.
- Immediate revocation. When a member of staff or a supplier leaves, their access is closed the same day.
- An up-to-date list of who has access to what.
What to do if an account has been compromised
- Change the password from a clean device.
- End all open sessions.
- Check email forwarding rules and connected apps: attackers create hidden ones.
- Change the passwords of accounts that used the same one or that can be recovered through that mailbox.
- If personal data is involved, assess whether you must notify the Garante (Italy's data protection authority) within 72 hours.
A checklist
- Does everyone use a password manager?
- Do email and admin panels have a second factor?
- No passwords shared in chats or spreadsheets?
- Access list up to date and former staff accounts closed?
- Have the default credentials on devices been changed?
Further reading: phishing at work · ransomware · website care and maintenance
Frequently asked questions
How long should a password be?
NIST (SP 800-63B-4) requires at least 15 characters when the password is the only authentication factor and at least 8 when it is part of multi-factor authentication. Systems should allow at least 64 characters.
Should you make people change their passwords every three months?
No. NIST states that periodic changes must not be imposed. A password should be changed when there is evidence it has been compromised.
Do you need to require capitals, numbers and symbols?
No. NIST prohibits imposing other composition rules. What counts is length and the password not appearing in a list of known or already compromised passwords.
Is an SMS code a good second check?
It is better than nothing but it is not phishing-resistant. NIST states that manually entered OTPs and out-of-band authentication are not phishing-resistant. Passkeys and security keys based on WebAuthn are.