Password and Authentication Policy
Establishes Your Organization requirements for passwords, multi-factor authentication, credential rotation, and authentication of human and service accounts.
Maps to ISO/IEC 27001:2022 A.5.17 · FedRAMP Moderate IA-5
Read it now — the PDF opens either way.
Purpose
Authentication is the control that binds an identity to every action taken on Your Organization systems. Weak authentication undermines every downstream control — access control, logging, data protection, and incident response. This policy establishes Your Organization's minimum requirements for passwords, multi-factor authentication (MFA), and credential management across human and non-human identities.
Scope
This policy applies to all authentication to Your Organization information systems — corporate identity provider, SaaS applications, internal systems, databases, infrastructure consoles, VPN and zero-trust gateways, physical access systems, and service accounts. It applies to all workforce members, contractors, and third parties.
7 more sections in the full template
Password requirements · Multi-factor authentication · Service accounts and non-human identities · Session management · Lost, compromised, or suspected-compromised credentials · Scope exceptions · Review cadence. Download the full document above, or open it in CMDash to fill in your organization name and effective date automatically.
Use this policy for real, not just on paper
“Open in CMDash” pre-selects the Password and Authentication Policy template the first time you create a policy — your organization name and today’s date fill in automatically, and it lands as a DRAFT you can edit before publishing.