Most password policies small businesses inherited are no longer fit for purpose. The rules you inherited tend to focus on forcing users to include uppercase letters, numbers, and symbols — rules that NCSC guidance has explicitly discouraged for years, yet still appear on the wall in many offices and in the default settings of every new helpdesk ticket.

Password security for SMEs in 2026 is not about building a password that looks complex. It is about three things: making passwords long enough that automated guessing takes effort, ensuring no password is used twice, and backing up the whole exercise with multi-factor authentication wherever it is available. Those three principles are now the foundation of the NCSC's password guidance, and they form the technical basis of the Cyber Essentials secure configuration and user access control requirements.

This guide explains what SMEs actually need to do about password security now — not what a generic security blog suggests, but what the current scheme requirements, the current NCSC guidance, and real-world SME environments actually demand.

What Cyber Essentials Actually Requires Passwords to Do

Is Your Password Policy Actually Protecting Your Business?

Cyber Essentials is a baseline security scheme run under the NCSC umbrella and administered by IASME. Two of its five controls deal directly with passwords: secure configuration and user access control. The requirements are deliberately minimal on what users must do and deliberately specific on what systems must enforce.

On secure configuration, an organisation must demonstrate that it has:

• A password policy that instructs users not to use the same password anywhere else, at work or at home

• A policy that tells users not to choose common passwords — this can be implemented by technical means such as an automated deny list

• A policy that tells users how to avoid obvious passwords based on easily discoverable information

• A minimum password length of at least 8 characters, with no maximum length

On user access control, an organisation must demonstrate that it has:

• Implemented multi-factor authentication on all administrator accounts

• Implemented MFA on all accounts that are internet-accessible (including cloud services)

• A process to change passwords promptly when compromise is suspected

There is no requirement to enforce regular password expiry, and there is no requirement to enforce complexity rules requiring upper-case, lower-case, numeric, and special character combinations. Both of those are explicitly recommended against by the NCSC.

The practical effect is that Cyber Essentials shifts the password burden away from users following memorability tricks and towards systems doing the heavy lifting: deny lists, account lockout, throttling, and MFA. That is a deliberate design choice, not an oversight.

Why Traditional Complexity Rules Are Problematic

The typical SME password policy you see posted on an office wall or embedded in an old Active Directory template will specify something like: minimum eight characters, must include upper and lower case, a number, and a symbol. The NCSC has been clear that these complexity requirements are a poor defence.

Complexity requirements do not protect against phishing. They do not protect against credential stuffing, where attackers use leaked password lists from other breaches. They do not protect against password spraying, where attackers try a small number of common passwords across many accounts. They do not even protect well against brute force attacks, because the characters most people add in response to complexity rules are entirely predictable: capitalise the first letter, replace 'a' with '@', add '1' at the end.

What complexity rules do is force users into habits that weaken security: writing passwords on sticky notes, reusing variations of the same password across multiple accounts, and sharing passwords over Teams or email because the policy has made them so unwieldy to remember.

The NCSC guidance on password administration for system owners is explicit: "Do not use complexity requirements when implementing user generated passwords." It recommends specifying only a minimum length, preventing very short passwords, and avoiding any maximum length cap that users might try to exceed.

What Makes a Password Hard to Crack

Length is the single most effective defence against automated cracking. A password of twelve characters using only lowercase letters and numbers has 62^12 possible combinations. An eight-character password with the same character set has 62^8. The difference is not marginal — it is the difference between seconds and years on cracking hardware available to even moderately resourced attackers.

The IASME Cyber Essentials Knowledge Hub on the value of passwords puts the current position clearly. Accounts protected by a password alone need to ensure that the password has at least 12 characters, with no maximum length. If an account has the additional protection of MFA enabled, the password needs to be at least 8 characters long, also with no maximum length.

These are not the NCSC's ideal recommendations — they are the minimum lengths at which Cyber Essentials assessors will expect to see evidence that an SME's password policy provides a meaningful barrier. The gap between 8 and 12 characters matters because it directly affects whether an attacker can move from a password spray (trying common passwords across many accounts) to a brute force attack (systematically guessing every combination).

The NCSC's preferred approach for users who must choose their own passwords is the three-random-words technique — a passphrase that is long, memorable, and hard to crack. But the NCSC also recognises that most people cannot memorise dozens of three-word passphrases. That is why they recommend password managers: generate a unique, random password for every account, and store them in a tool protected by one strong master passphrase with MFA enabled.

The Most Common Password Mistakes SMEs Make

In practice, the same handful of mistakes keep appearing across SME environments, regardless of industry or turnover.

Password reuse across accounts

Sixty-six percent of users admit to reusing passwords, according to industry surveys from password manager vendors. For an SME, this is particularly dangerous because a compromise on one account — a breached supplier portal, a leaked dataset from a cloud service — immediately gives an attacker access to every other account where the same credentials are used. The IASME Knowledge Hub identifies credential stuffing as one of the two primary methods of account theft, alongside phishing.

The fix is straightforward: unique password for every account. A password manager makes this practical.

Writing passwords down insecurely

Sticky notes on monitors, spreadsheets on shared drives, forwarded Teams messages containing credentials — these are common. The IASME Knowledge Hub notes that local discovery and dumpster diving remain effective attack methods for opportunistic attackers. But more often, insecure credential storage enables the secondary effects of other attacks.

The Cyber Essentials policy requires that you tell users where and how they may record passwords to store and retrieve them securely. If the answer is "in a drawer" or "in an Outlook draft folder," you do not meet the requirement.

No deny list for common passwords

Many SMEs set their minimum length to eight characters and assume that is sufficient. Without a deny list that blocks the most commonly breached passwords — the NCSC has published a list of the 100,000 most commonly breached passwords — users will naturally pick from the top entries on that list, and attackers know exactly which ones to try first.

A deny list is cheap to implement in Active Directory, in Entra ID, and in most cloud administration platforms. It is also one of the three acceptable ways to meet the Cyber Essentials requirement for common password prevention.

MFA not enabled on all internet-facing accounts

This is the single biggest gap. The NCSC and IASME are clear: all internet-accessible accounts and all administrative accounts must have MFA. Many SMEs have MFA on email but not on their CRM, not on their accounting software, not on their project management tools. A compromised credential on an unprotected cloud service becomes the attacker's beachhead.

Microsoft estimates that accounts using MFA are more than 99.9% less likely to be compromised. That is not a platitude — it is a measurement from the platform most SMEs depend on.

How to Build a Password Policy That Actually Works

Building a password policy that meets current expectations does not require enterprise-grade infrastructure. It requires five decisions, documented and enforced:

Decide on length. Set a minimum of 12 characters for accounts without MFA, 8 characters for accounts with MFA. Do not set a maximum length. This applies to user accounts, service accounts, and administrative accounts.

Decide on a deny list. Use the NCSC's 100,000 commonly breached password list as your starting point. Most identity platforms can check against this list at the point of creation and, ideally, periodically against your existing database.

Decide on MFA coverage. Administrator accounts and all internet-facing accounts are non-negotiable. But think beyond those: every cloud service your team actually uses should have MFA enabled, even if it is not strictly required by the scheme.

Decide on a password manager. If staff are choosing their own passwords, you need a password manager. If you manage Active Directory, tools like KeePass with a shared database on your file share can work. For cloud-first teams, a dedicated business password manager with admin consoles and shared vaults is more practical.

Decide on a leaver process. When someone leaves, every shared credential they could access must be identified, rotated, or removed. This is not an IT nicety — it is the difference between a clean departure and a lingering access point.

None of these decisions requires you to choose a single vendor or commit to a long-term contract. They are operational decisions that define what your standard looks like. That is the difference between control and guesswork in IT management: you decide the baseline, you enforce it, you prove it, and you maintain it.

The Role of Passkeys and Passwordless Authentication

Passwordless authentication methods have received attention in recent years, and the April 2025 Cyber Essentials revision explicitly included passwordless methods as an acceptable alternative to traditional passwords. This includes biometric verification, security keys, one-time codes, and push notifications.

For most SMEs in 2026, passwords remain the default authentication method. Passkeys are supported by Microsoft Entra ID, by Google, and by several major SaaS providers, but adoption across the tools an SME actually uses is still partial. The practical approach is to enable passkeys where available — particularly for admin accounts and high-value services — while maintaining a strong password policy for accounts that still rely on credentials.

This is not a call to abandon passwords entirely. It is a call to use them where they are still necessary and to replace them where the tooling now supports it.

Connecting Password Security to the Broader Baseline

Password security does not exist in isolation. It is one element of the secure configuration and user access control controls, and its effectiveness depends on everything else around it: whether you have endpoint protection that blocks malicious software from capturing credentials, whether your backup strategy provides an independent copy of data that ransomware cannot reach, whether your joiner-mover-leaver processes actually disable accounts in real time rather than when someone remembers to.

These controls work together. A strong password policy with weak endpoint protection is vulnerable to keyloggers. A strong password policy with no backup is vulnerable to ransomware that encrypts your data after gaining access. A strong password policy with no leaver process is vulnerable to former employees retaining access.

The SMEs that get through Cyber Essentials assessments without surprise findings are not the ones that spend the most on security tools. They are the ones that have a baseline — a documented set of standards that apply consistently, that are maintained over time, and that can be evidenced at assessment.

Frequently Asked Questions

What minimum password length does Cyber Essentials require?

Cyber Essentials requires a minimum of 8 characters with no maximum length. However, accounts protected by password alone — those without MFA — should use at least 12 characters. This distinction reflects the trade-off between password length and the additional protection provided by a second authentication factor.

Does Cyber Essentials require password complexity?

No. The scheme does not require complexity rules mandating upper-case letters, numbers, or special characters. The NCSC guidance explicitly recommends against complexity requirements. What Cyber Essentials requires is a policy that prevents users from choosing common or obvious passwords, which is typically implemented through a deny list.

Does Cyber Essentials require regular password rotation?

No. The scheme does not require regular password expiry, and the NCSC advises against forcing regular password rotation. The requirement is to change passwords promptly when compromise is suspected or known.

Is MFA required for all user accounts under Cyber Essentials?

Cyber Essentials requires MFA on all administrator accounts and all accounts that are accessible from the internet (including cloud services). Standard user accounts that operate only on internal devices are not explicitly required to have MFA, though they must be protected by a password of at least 12 characters (or 8 characters plus a deny list or MFA).

How often should passwords be changed?

There is no scheme requirement for periodic password changes. The NCSC advises against forcing regular rotation, as evidence does not show that mandated rotation improves security. Instead, focus on ensuring passwords are long, unique, and protected by a deny list and MFA where available. Change passwords promptly if compromise is suspected.

Next Steps

If you are unsure whether your current password policy meets current expectations, the first practical step is to map what you have against what the scheme requires and what the NCSC recommends. That mapping — across secure configuration, user access control, MFA coverage, and credential management — is what a Security Triage Call is designed to produce.

Understanding your current gaps takes less time than assuming nothing needs to change. Book a Security Triage Call to review your baseline.