Password and Multi-Factor Authentication Policy
Password and Multi-Factor Authentication Policy template for setting password standards, MFA requirements, account recovery controls, and user responsibilities. Use it to define who must use MFA, how passwords are managed, and what happens when exceptions are needed.
Trusted by frontline teams 15 years of frontline software AI customization in seconds
Built for: Technology · Healthcare · Financial Services · Professional Services · Retail
Overview
This Password and Multi-Factor Authentication Policy template sets the rules for creating, protecting, resetting, and recovering user credentials, and for requiring MFA on sensitive accounts and systems. It is meant for organizations that need a clear, enforceable standard for employees, contractors, administrators, and other users who access company resources.
Use it when you need to define password length, reuse limits, lockout thresholds, approved MFA methods, account recovery steps, and user responsibilities such as not sharing credentials or approving push prompts without verification. It also helps you document who can approve exceptions, how privileged accounts are handled, and what happens when a user repeatedly fails authentication or reports a suspected compromise.
Do not use this template as a generic cybersecurity statement with no operational detail. If you need a broader information security program, incident response plan, or vendor access agreement, those should be separate documents. This policy is also not a substitute for system-specific technical controls; it should match what your identity platform, help desk, and device management tools can actually enforce. The best use is as a policy holder-approved standard that can be implemented, audited, and revised when authentication methods, risk levels, or legal requirements change.
Standards & compliance context
- This template supports reasonable administrative safeguards that often sit alongside privacy and security obligations under GDPR and CCPA when employee or customer data is accessed through authenticated systems.
- If authentication controls are part of a broader workplace security program, they should be consistent with employer obligations under general duty expectations and any applicable state privacy or breach-notification rules.
- Where the policy affects access to payroll, leave, or personnel systems, it should be administered consistently to avoid discrimination concerns under Title VII, ADA, ADEA, and related EEOC guidance.
- If the policy is used to protect records tied to wage and hour administration, it should support accurate access control for FLSA-related data and audit trails.
- State-specific privacy and security requirements may impose additional notice, retention, or access-control expectations, so California employees and other jurisdiction-specific groups should be called out explicitly in the scope or carve-outs.
General regulatory context for orientation only — verify current requirements with counsel or the relevant agency before relying on this template for compliance.
What's inside this template
Purpose
Explains why the policy exists and what risk it is meant to reduce.
-
This policy establishes minimum standards for password creation, password protection, multi-factor authentication (MFA), account recovery, and user responsibilities to reduce the risk of unauthorized access, data loss, payroll fraud, and business disruption. The policy is intended to support secure access to company systems while respecting employee rights and applicable legal requirements, including the ADA interactive process for accommodation requests, Title VII protections under the EEOC framework, FLSA timekeeping integrity, and NLRA Section 7 rights. Where state or local law provides additional requirements, the company will apply the stricter standard. California employees: privacy and notice obligations under the CCPA may apply to authentication and account recovery data. The company will not use this policy to interfere with protected concerted activity under the NLRA or to restrict lawful wage discussions, complaints, or other protected rights.
Scope
Defines which users, systems, and jurisdictions the policy applies to.
-
This policy applies to all employees, contractors, temporary workers, interns, and any other person granted access to company systems, including email, HRIS, payroll, finance, customer systems, cloud applications, and remote access tools. Applicable roles include employees with standard access, managers approving access changes, IT administrators performing resets or provisioning, and HR or payroll staff handling identity verification for account recovery. California employees: any collection, storage, or use of authentication-related personal information must be limited to legitimate business purposes and handled in accordance with applicable privacy law. New York, Illinois, Washington, and other state-specific employment or privacy rules will be followed where they impose additional obligations.
Policy
States the actual password and authentication rules users must follow.
-
1. **Password standards** - Passwords must be unique for each system and must not be reused across company or personal accounts. - Passwords must be at least 14 characters unless a system has a longer minimum requirement. - Passwords must not include the employee's name, username, birth date, repeated patterns, common words, or easily guessed phrases. - Passwords must not be shared, written on visible notes, stored in unsecured files, or transmitted in plain text. - Password managers approved by IT may be used. 2. **MFA requirements** - MFA is required for all remote access, email, payroll, HR, finance, privileged/admin access, and any system designated by IT Security. - Approved MFA methods include authenticator apps, hardware security keys, and other company-approved phishing-resistant methods. - SMS-based MFA may be allowed only when no stronger method is available and must be approved by IT Security. - Users must not approve unexpected MFA prompts and must report suspicious prompts immediately. 3. **Account recovery controls** - Password resets and account recovery must follow documented identity verification steps before access is restored. - IT or HR may require verification through company records, manager confirmation, government-issued identification review, callback procedures, or other approved methods. - Recovery requests involving payroll, banking, or benefits systems require heightened verification and manager or HR approval where appropriate. - Shared accounts are prohibited unless specifically approved for a business need and controlled by IT. 4. **User responsibilities** - Users must protect credentials, lock devices when unattended, and log out of shared or public devices. - Users must immediately report suspected phishing, lost devices, unauthorized access, or accidental disclosure of credentials. - Users must complete required security training and MFA enrollment by the stated deadline. - Users must cooperate in good-faith with investigations, resets, and verification steps.
Procedure
Shows the step-by-step process for enrollment, reset, recovery, and exception handling.
-
1. **Password creation and change process** - During account setup, users must create a unique password that meets the minimum length and complexity requirements. - IT systems should block commonly used or compromised passwords where technically feasible. - Passwords must be changed immediately if compromise is suspected or confirmed. 2. **MFA enrollment and use** - New users must enroll in MFA before receiving production access. - Existing users must enroll by the deadline communicated by IT Security. - If a user loses access to an MFA device, the user must notify IT immediately and complete the approved recovery process. 3. **Account recovery and reset** - The help desk or designated verifier must confirm identity using the approved verification checklist before resetting credentials. - High-risk accounts require step-up verification and may require manager, HR, or security approval. - Recovery records must be documented, including date, verifier, method used, and any exceptions approved. 4. **Accommodation requests** - Employees who need an alternative authentication method due to a disability or medical limitation may request a reasonable accommodation. - HR and IT will engage in the interactive process to determine whether an effective alternative control can be provided without creating undue hardship or unacceptable security risk. - Temporary accommodations may be used while the request is reviewed. 5. **Incident reporting** - Suspected phishing, credential theft, or unauthorized access must be reported immediately to IT Security and the employee's manager. - IT Security will assess whether account lockout, forced reset, device review, or broader incident response steps are required.
Roles & Responsibilities
Assigns ownership for enforcement, support, approvals, and communication.
-
**Employees and contractors** - Create and protect strong passwords. - Use MFA as required. - Report suspected compromise immediately. - Complete training and follow recovery steps in good-faith. **Managers** - Ensure team members complete required enrollment and training. - Escalate access issues that may affect essential functions or business continuity. **IT Security / IT Administrators** - Configure password and MFA controls. - Maintain approved recovery procedures and logs. - Review exceptions and security incidents. - Implement technical controls to detect weak or compromised passwords where feasible. **HR / Payroll / Compliance** - Support identity verification for sensitive recovery requests. - Coordinate accommodation requests through the interactive process. - Preserve records consistent with retention and privacy requirements. **Policy holder** - Review the policy annually and approve updates based on legal, operational, or security changes.
Compliance, Exceptions, and Discipline
Explains how violations, carve-outs, and corrective action are handled.
-
Failure to comply with this policy may result in access suspension, mandatory retraining, documented warning, a performance improvement plan (PIP), or other corrective action up to and including termination, subject to applicable law and any collective bargaining agreement. Exceptions must be documented, time-limited, approved by IT Security and HR or Compliance, and reviewed for risk. Any exception for an ADA-related accommodation must be handled through the interactive process and documented separately from disciplinary matters. This policy will be applied in a manner consistent with the NLRA, including employees' rights to engage in protected concerted activity, and will not be used to discourage lawful wage discussions or workplace complaints. FLSA-related timekeeping, overtime, and classification issues must be escalated promptly if access controls affect work hours or off-the-clock activity. California employees: any disciplinary or access decision involving personal data or device access must be reviewed for CCPA and other applicable privacy obligations. Where state law provides greater protection, the company will follow the more protective rule.
Review & Revision
Sets the cadence for updates and the trigger points for policy changes.
-
This policy will be reviewed at least annually and updated as needed based on security incidents, audit findings, legal changes, or changes to business systems. The policy holder is responsible for maintaining the current version, documenting revisions, and communicating material changes to affected users. Version history, approval dates, and exception logs should be retained according to the company's record retention schedule and applicable legal requirements.
How to use this template
- 1. Set the effective_date, version, applicable_jurisdictions, applicable_roles, and review_frequency before publishing the policy.
- 2. Define the password standard, MFA methods, account recovery steps, and exception approval process so the policy matches your identity and access systems.
- 3. Assign ownership to IT or Security, and specify how HR, managers, and the help desk will communicate and enforce the rules.
- 4. Roll out the policy with user training that explains enrollment, reset requests, phishing-resistant verification, and what to do if access is lost.
- 5. Review exceptions, failed login trends, and recovery requests on a regular basis, then update the policy when controls or legal requirements change.
Best practices
- Require MFA for remote access, email, payroll, HR, and any system that stores sensitive personal or financial data.
- Use separate rules for privileged accounts so administrators have stronger authentication and tighter recovery controls than standard users.
- Define account recovery steps that verify identity through approved channels before any reset is completed.
- State a clear lockout or escalation path for repeated failed logins, suspected phishing, or compromised credentials.
- Prohibit password sharing, reuse across systems, and informal reset approvals by managers or coworkers.
- Document every exception with a business reason, an expiration date, and policy holder approval.
- Align the policy language with the actual tools in use so users are not promised controls the organization cannot enforce.
What this template typically catches
Issues teams running this template most often surface in practice:
Common use cases
Frequently asked questions
Who should use this policy template?
Use this template if your organization wants a written rule set for password creation, MFA enrollment, account recovery, and user responsibilities. It fits HR, IT, and security teams that need a policy holder-approved standard for employee access. It is especially useful when you need one document that applies to employees, contractors, and other users with company accounts.
Does this template cover both passwords and multi-factor authentication?
Yes. It is designed to cover password complexity, reuse limits, reset requirements, MFA enrollment, approved authentication methods, and recovery controls. The policy should also state when MFA is mandatory, such as for email, payroll, HR systems, remote access, and privileged accounts.
How often should this policy be reviewed?
Review it at least annually, and sooner after a security incident, major system change, or change in legal requirements. Annual review_frequency is important because authentication standards and threat patterns change quickly. The policy should also include an effective_date and version so updates are traceable.
Who should own and enforce this policy?
IT or Information Security usually owns the technical standards, while HR helps communicate expectations and apply discipline consistently. Managers should not create local exceptions on their own, and the policy holder should approve any exception. For access tied to regulated data, legal or compliance may also need to review the controls.
What laws or standards does this policy usually support?
This template is commonly used to support broader security and privacy obligations under federal and state law, including data protection expectations that may arise under GDPR or CCPA. It also helps show reasonable administrative controls when handling employee, customer, or applicant data. If your organization is in a regulated industry, you may need to align the policy with sector-specific security requirements as well.
What are the most common mistakes in a password and MFA policy?
Common mistakes include allowing exceptions without approval, failing to define MFA for remote access, and not stating what happens after repeated failed logins or suspected compromise. Another gap is leaving account recovery too loose, which can undermine the whole policy. A good template should also avoid vague language like 'use strong passwords' without defining the actual standard.
Can this template be customized for different user groups?
Yes. You can tailor it for employees, contractors, administrators, third-party vendors, and service accounts. Many organizations also add role-based rules for privileged access, shared accounts, or systems that cannot support modern MFA. The template should make those carve-outs explicit instead of relying on informal practice.
How does this policy compare with ad hoc password rules?
An ad hoc approach usually leaves gaps in recovery, exceptions, and enforcement, which makes it hard to prove consistent control. This template gives you a documented standard for onboarding, access changes, resets, and discipline. It also helps reduce confusion because users know what is required before they are locked out or granted access.
Related templates
Ready to use this template?
Get started with MangoApps and use Password and Multi-Factor Authentication Policy with your team — pricing built for small business.
