How to answer
What is your password policy?
One of the few questions where the modern answer looks weaker than the old one and is in fact much stronger.
Passwords must be at least [12] characters, are checked against a breached-password list, and are stored using a modern password hashing function. Multi-factor authentication is required in addition to a password for all employee accounts, and passwords are not rotated on a schedule.
Square brackets are yours to fill in. FillTrust grades an answer like this confirmed in your documents when your documents support it.
- Answered from
- Your access control policy or information security policy.
- Evidence to attach
- Rarely anything. Occasionally a screenshot of the password settings in your identity provider.
- Where it is asked
- CAIQ v4.0 · IAM-02SIG LiteISO 27001 Annex A · A.5.17
This question is a small test of whether your security programme has been updated in the last five years, and the answer that scores worst is the one that sounds strictest.
Length beats composition. Current guidance, from NIST 800-63B onward and now reflected in most auditors' expectations, is a minimum length of at least 8 and preferably 12 or more, with no mandatory mix of character classes. Composition rules push people toward predictable substitutions and a note in a drawer. If your policy still requires an uppercase, a number and a symbol, it is not a disaster, but it is dated.
Rotation is the one that has genuinely reversed. Forced periodic rotation is no longer recommended and actively encourages weaker passwords. If you do not rotate, say so deliberately rather than leaving it out: "passwords are not rotated on a schedule; they are changed on suspicion of compromise" is a considered answer, whereas silence reads as an omission.
Breached-password checking is the strongest single sentence available. Screening new passwords against a known-breach list does more for real-world risk than every composition rule combined, and most identity providers offer it. If you have it on, say so early in the answer.
Say how they are stored, and say hashed. For your own product, the expected answer names a modern password hashing function with a work factor. Writing "encrypted" instead of "hashed" is a common slip and it means something different: encryption is reversible, which is exactly what you do not want.
Say who the policy covers. Employee accounts and end-user accounts in your product are two different answers, and questionnaires often ask about both in one line. If you enforce different rules, give both in two sentences rather than averaging them into something true of neither.
Finally, if multi-factor authentication is required, that fact belongs in this answer as well as in its own. It changes what the password has to carry, and a reviewer reading a modest password policy alongside enforced MFA reads a coherent programme rather than a weak one.
How this one goes wrong
Specific to this question, not general advice.
- Answering with the 2010 policy: 8 characters, one uppercase, one symbol, rotate every 90 days. It is worse security than the modern answer and a reviewer who knows the NIST guidance reads it as an out-of-date programme.
- Answering for employees when the question means end users, or the reverse. If the questionnaire is about your product, they are asking what you enforce on their staff.
- Saying passwords are encrypted. They should be hashed, and the distinction is one a security reviewer will notice.