Rethinking Passwords: What You Should Know

If you’ve ever been frustrated by password rules that require a jumble of uppercase letters, numbers, and special characters—only to be forced to change it every 90 days—you’re not alone. The good news? The latest guidance from the National Institute of Standards and Technology (NIST) and Microsoft is turning that model on its head.

Here’s what’s changed, and how your business can benefit.

🔑 Complexity Is Out, Length Is In

NIST’s updated guidelines, reflected in Special Publication 800-63B, now recommend longer passwords over complex ones. That means a passphrase like “correcthorsebatterystaple” is more secure—and easier to remember—than “P@55w0rd!”.

Microsoft agrees. In fact, they’ve removed mandatory complexity requirements from their baseline security recommendations. Instead, they encourage user-friendly passphrases that are at least 12 characters long and easy to recall.

🔁 No More Forced Password Expirations

One of the most impactful changes? No more routine password resets. NIST and Microsoft both advise against requiring users to change passwords every 60 or 90 days unless there’s evidence of compromise. Frequent resets often lead to weaker passwords and frustrated users.

Instead, the focus is on monitoring for breaches and prompting changes only when necessary. This reduces friction and improves security by encouraging users to create strong, lasting credentials.

🚫 Ban Common and Compromised Passwords

Rather than relying on arbitrary rules, the new approach emphasizes screening passwords against known breach data. This means blocking passwords like “123456” or “qwerty” even if they meet length or character requirements.

As your MSP, we implement real-time password filtering tools that check new credentials against massive databases of compromised passwords. This helps prevent your team from using credentials that attackers already know.

🔐 Embrace Multi-Factor Authentication (MFA)

While strong passwords are important, MFA is now considered essential. Microsoft reports that MFA can block over 99 percent of account compromise attacks. We help SMBs implement MFA across email, cloud apps, and remote access tools to add a critical layer of protection.

🧭 What This Means for Your Business

These changes aren’t just about security—they’re about usability. By adopting modern password policies, you can:

• Reduce helpdesk tickets related to password resets
• Improve employee satisfaction and productivity
• Strengthen your overall security posture
• Stay aligned with compliance frameworks like FTC Safeguards and HIPAA

We help you implement these best practices with tools that enforce length, block weak passwords, and support MFA—without adding complexity for your team.

✅ Let’s Modernize Your Password Policy

If your current password policy still relies on outdated complexity rules or frequent resets, it’s time for an upgrade. We’ll help you align with the latest NIST and Microsoft guidance, reduce risk, and make life easier for your team.

Reach out today for a quick policy review or to learn how we can help you modernize your security stack.