Your Company Password Policy Might Be Making Security Worse
Yes, a traditional company password policy can make security worse. Forcing everyone to change passwords every 90 days and to mix capitals, numbers and symbols pushes people towards predictable patterns, written-down notes and reused passwords. The US National Institute of Standards and Technology (NIST) now says verifiers "SHALL NOT require subscribers to change passwords periodically" and "SHALL NOT impose other composition rules", and Microsoft gives similar advice for Microsoft 365.
This opinion piece compares the old rules with current guidance, argues both sides, and shows how multi-factor authentication (MFA), passkeys and Windows Hello hardware such as the ASUS ExpertBook P3, ASUS ExpertBook B1, Lenovo ThinkPad T14 Gen 7 and ViewSonic VG2757V-2K monitor take passwords out of the daily routine.
Old password rules vs current guidance
| Common company rule | What current guidance says | Better policy |
|---|---|---|
| Change every 60 or 90 days | NIST: do not require periodic changes; force a change when there is evidence of compromise. Microsoft recommends passwords never expire for cloud-only accounts | Change on compromise, not on a calendar |
| Must contain upper, lower, number and symbol | NIST: do not impose composition rules | Ask for length instead |
| Minimum 8 characters | NIST: at least 15 for a password used alone, 8 when part of MFA; Microsoft recommends 14; CSA suggests passphrases of at least 12 | Long passphrases, at least 14 to 15 characters |
| Security questions for resets | NIST: do not use knowledge-based security questions | MFA-backed self-service reset |
| Block paste and password managers | NIST: allow password managers and autofill; paste should be permitted | Issue a company password manager |
| No check against known bad passwords | NIST: compare new passwords with a blocklist of common and compromised passwords | Turn on banned-password checks |
Why forced password changes backfire
Microsoft's password policy guidance for Microsoft 365 puts it bluntly: "research shows that almost every rule you impose on your users results in a weakening of password quality. Length requirements, special character requirements, and password change requirements all result in normalization of passwords, which makes it easier for attackers to guess or crack passwords." Its recommended setting is for passwords to never expire.
Anyone who has worked in an office has seen the pattern: a base word with a number at the end that goes up by one each quarter, the same password used for the payroll portal and a shopping site, a sticky note under the keyboard. None of that is laziness; it is a predictable response to rules that ask people to remember something new, complex and meaningless several times a year. The Cyber Security Agency of Singapore (CSA) warns against exactly these habits, telling people to avoid predictable patterns "such as adding '1' to the end of a common word".
The case for keeping strict rules
There is a fair argument on the other side. Some industry frameworks, client contracts and audit checklists still list expiry and complexity rules, and changing them means updating documents and explaining the change to auditors. Periodic changes also limit how long a stolen password stays useful if nobody notices the theft. And CSA's public advice still suggests mixing uppercase and lowercase letters, numbers or symbols "to make it even harder to crack".
Our view: the second argument only holds if you have no way to detect compromise, and the fix for that is MFA and sign-in monitoring, not a calendar reminder. NIST keeps the forced change for when there is evidence of compromise. Character mixing inside a long passphrase does no harm if people choose it; the problem is mandating it on short passwords. If an auditor or contract requires expiry, document the requirement and the compensating controls, rather than assuming the old rule is best practice.
Stop asking staff to remember more. Ask them to type less, and make the password the least important part of signing in.
What should a modern company password policy say?
A short, defensible policy for a Singapore SME looks like this:
- Length over complexity. NIST sets 15 characters as the minimum for a password used on its own, and says systems should permit at least 64. Microsoft recommends a 14-character minimum. CSA recommends passphrases that are "long (with at least 12 characters) and random", such as several words tied to a memory unique to you.
- No calendar expiry. Change passwords when there is evidence of compromise, after a phishing click, or when someone leaves; see Your Ex-Employee Might Still Have Access to Company Data.
- Block bad passwords. NIST requires checking new passwords against a blocklist of commonly used, expected or compromised passwords, and Microsoft calls banning easy-to-guess passwords the most important requirement.
- A password manager for everyone. NIST says verifiers "SHALL allow the use of password managers and autofill functionality". CSA advises using a different password for each account and choosing a password manager that offers 2FA.
- MFA everywhere it is offered. Microsoft recommends enforcing MFA registration; CSA notes 2FA protects an account even if someone obtains the password.
- No security questions or hints. NIST rules out both.
Passkeys and Windows Hello: replacing the password
The longer-term fix is to stop relying on shared secrets. The FIDO Alliance describes passkeys as FIDO credentials that "replace passwords with cryptographic key pairs for phishing-resistant sign-in security", used from "computers, phones, or security keys", so "there are no passwords to steal" from a breach. Microsoft's Windows Hello for Business works on similar principles: a device-specific credential combined with a biometric or PIN, where "the PIN never leaves the device" and biometric data is stored on the local device only. Microsoft describes it as phish-resistant two-factor authentication, with a caveat that Windows Hello on a local account does not offer the same key-based protection as a Microsoft Entra or Microsoft account.
That makes the laptop part of your password policy. If a stolen laptop is your worry, read One Stolen Laptop. How Much Could It Really Cost Your Business?, and for why business laptops carry these features, see business vs consumer laptops.
Which laptops support Windows Hello sign-in?
These store listings state biometric sign-in hardware (prices as listed on 23 Oct 2026, all in stock at the time of writing):
- ASUS ExpertBook P3 P3406CCA-LY0040X (S$2,099.00): fingerprint sensor in the power key and an IR camera for Windows Hello face recognition, with a privacy shutter, plus BIOS self-recovery and Intel Boot Guard. The listing states 3 years onsite service, next business day.
- ASUS ExpertBook B1 B1403CVA-NJ1209X (S$1,499.00): fingerprint sensor in the touchpad for Windows Hello, TPM 2.0 and a webcam shutter, with 3 years onsite service stated. Code EXPERTBOOK10 takes 10% off the B1 and P3 14-inch until 30 Nov 2026; details in our ExpertBook B1 vs P3 deal post.
- Lenovo ThinkPad T14 Gen 7 (Core Ultra 5 325, 3Y Onsite) (S$2,301.00): touch-style match-on-chip fingerprint reader in the power button and discrete TPM 2.0.
- For desktops, the ViewSonic VG2757V-2K 27-inch monitor (S$673.20) has a 5MP pop-up webcam that supports Windows Hello face sign-in, plus USB-C docking with 90 W charging.
More options are in notebook deals and the ASUS ExpertBook range. Pair new hardware with properly licensed software, as we explain in non-genuine Microsoft software as a cybersecurity risk.
SourceIT's verdict
Drop calendar expiry and complexity mandates, require length, block known-bad passwords, give staff a password manager, and switch on MFA. Then move sign-in to Windows Hello and passkeys so the password becomes a fallback. Passwords are only one layer; office printers and unmanaged devices matter too, as covered in Your Office Printer Could Be the Weakest Link in Your Network and The Most Dangerous Device in Your Office Might Be the One Nobody Manages, and ransomware defence in preventing ransomware in Singapore. SourceIT supplies Lenovo and ViewSonic with local warranty. For fleet orders, see volume discounts and special pricing, call (65) 6978 3502 or email Sales@sourceit.com.sg.
Frequently asked questions
Should company passwords expire every 90 days? Current NIST guidance says systems should not require periodic password changes, only a forced change when there is evidence of compromise. Microsoft recommends that Microsoft 365 cloud-only passwords never expire.
How long should a company password be? NIST sets a minimum of 15 characters for a password used on its own and 8 when it is part of MFA. Microsoft recommends 14, and CSA suggests passphrases of at least 12 characters.
Are complexity rules still recommended? NIST says verifiers should not impose composition rules such as requiring mixed character types. Length and a blocklist of common passwords matter more.
Should we allow password managers? Yes. NIST says verifiers shall allow password managers and autofill, and CSA recommends a password manager with 2FA so each account gets a different password.
What is a passkey? The FIDO Alliance describes a passkey as a FIDO credential that replaces a password with a cryptographic key pair, making sign-in phishing-resistant, with keys used from computers, phones or security keys.
Does Windows Hello replace passwords at work? Windows Hello for Business combines a device-bound credential with a fingerprint, face or PIN, and Microsoft describes it as phish-resistant. Microsoft notes that on a local account it does not offer the same key-based protection as a Microsoft Entra ID or Microsoft account.
