Cyber Essentials Password Policy: The 2026 v3.3 Rules

The most common misunderstanding about Cyber Essentials passwords is that the scheme forces every account onto a 12-character minimum. It does not. Under Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026), you must manage password quality using one of three options — and if you have multi-factor authentication (MFA) switched on, an 8-character minimum is enough. Choosing the right option for each system is the difference between a policy your staff resent and one that passes assessment comfortably.

This guide sets out exactly what the current requirements say, so you can write a password policy that will not trip you up at assessment.

Three password quality options

The requirements state that you must “use technical controls to manage the quality of passwords”, and that this “will include one of the following”:

1. Using multi-factor authentication. Where MFA protects the account, the password element must be at least 8 characters, with no maximum length restriction.
2. A minimum password length of at least 12 characters, with no maximum length restrictions.
3. A minimum password length of at least 8 characters, with no maximum length restrictions, plus automatic blocking of common passwords using a deny list.

That is the whole rule. There is no 14-character tier, and no requirement to apply the same option everywhere — you can use MFA on your cloud services and a 12-character minimum on a legacy on-premise system that cannot support it.

So if you have already enforced MFA properly, your password length obligation is 8 characters, not 12. Spend the effort on making your MFA coverage genuinely complete instead.

Note the phrase that appears in all three options — “with no maximum length restrictions”. If any system in scope caps password length, that is a finding in its own right, regardless of which option you have chosen.

Blocking brute-force guessing with one control, not three

Separately from password quality, passwords must be “protected against brute-force password guessing by implementing at least one of”:

• Multi-factor authentication
• Throttling the rate of attempts, so the wait between attempts increases with each unsuccessful try. You should allow “no more than 10 guesses in 5 minutes”.
• Locking devices after no more than 10 unsuccessful attempts

Again, one of three — not all three. MFA satisfies this control and the quality control at the same time. That is why enforcing it properly is the biggest single win you can bank before assessment.

Where the scheme gives you no choice on MFA

The requirements are unambiguous on cloud: your organisation must “implement MFA, where available — authentication to cloud services must always use MFA”. There is no availability get-out for cloud services. If your Microsoft 365, Google Workspace, accounting platform or CRM supports MFA, it must be on.

You should also always use MFA for administrative accounts and for accounts accessible from the internet.

The requirements list four types of additional factor to consider:

• A managed or enterprise device
• An app on a trusted device
• A physically separate token
• A known or trusted account

On SMS, the NCSC’s position is pragmatic rather than prohibitive: SMS “is not the most secure type of MFA but still offers a huge advantage over not using any MFA at all”. If a better option is available for your situation, use it — but do not leave MFA off while you deliberate.

Why the scheme drops password expiry and complexity

Cyber Essentials asks you to help staff choose unique passwords. Two of the listed measures cut against habits many UK firms still have baked into Active Directory:

• “Not enforcing regular password expiry”
• “Not enforcing password complexity requirements”

If your policy still forces a 90-day rotation, or demands an uppercase-number-symbol formula, you are working against the guidance. Both habits push people towards predictable patterns and reuse. The scheme points you somewhere better instead. Teach staff to spot common passwords, promote the NCSC’s “three random words” approach, and give everyone a password manager.

You do still need “an established process in place to change passwords promptly if you know or suspect a password or account has been compromised” — event-driven changes, not calendar-driven ones.

Device unlock PINs at 6 characters, and the catch

This one confuses people at assessment more than anything else. Where a credential exists purely to unlock a device — a phone PIN, a laptop login — the requirement is “a minimum password or PIN length of at least 6 characters”.

But there is a catch worth reading twice: “when the device unlocking credentials are also used for authentication, you must apply the full password requirements”. On a domain-joined laptop, the login is usually doing both jobs, so the full rules apply. The 6-character allowance is narrower than it first appears.

Device unlocking credentials must also be protected against brute force, using the same throttling or lockout options above. Where a vendor does not let you configure this, the requirements permit you to use the vendor’s default setting.

Passkeys, while you rewrite the policy anyway

Version 3.3 widened passwordless authentication to include FIDO2. The requirements are explicit: “FIDO2 authenticators are regarded as MFA because user authentication is performed”. Passkeys, biometrics, security keys, push notifications and one-time codes all sit under that heading.

The NCSC took the same line formally at CYBERUK 2026. It now recommends passkeys as the default login method, and no longer recommends passwords where passkeys exist. For most firms that is a multi-year shift, not a switch to flip. But you are rewriting your authentication approach for certification anyway. Point it towards passkeys while you have the file open.

A compliant password policy checklist

1. Map every system in scope and record which authentication it uses. Cloud, on-premise, network devices, third-party and support accounts all count.
2. Enforce MFA on all cloud services — this is mandatory, not conditional — plus all administrative and internet-facing accounts.
3. Pick one quality option per system. MFA (8-character password element), 12 characters, or 8 characters plus a deny list.
4. Remove every maximum length cap you find.
5. Pick one brute-force control per system: MFA, throttling at no more than 10 guesses in 5 minutes, or lockout after no more than 10 attempts.
6. Turn off scheduled password expiry and complexity rules, and replace them with three-random-words guidance and a password manager.
7. Set device unlocking to at least 6 characters — and apply full password requirements wherever that credential also authenticates the user.
8. Write down your compromise-response process for prompt password changes.

Meeting the password rules without a rebuild

Most Cyber Essentials password failures we see are not about length at all — they are gaps in MFA coverage, a forgotten legacy system with a 16-character cap, or an expiry policy nobody has revisited since 2019. We audit every system in your scope, choose the right option for each, and configure it properly in Microsoft Entra ID or your directory of choice.

We take London firms through Cyber Essentials and Cyber Essentials Plus certification from gap analysis through readiness and assessment — and if you want the wider context, our guide to what changed in Cyber Essentials v3.3 covers the MFA, cloud and BYOD updates that land alongside these password rules. Strong authentication also sits behind the human-layer defences we run, such as anti-phishing testing, and it is one of the controls cyber insurers reward with lower premiums.

If you are unsure whether your current password policy would pass, book a free assessment with Nerdster. We will review it against the current question set and set out what needs to change.

---

Sources: Cyber Essentials: Requirements for IT Infrastructure v3.3, April 2026, National Cyber Security Centre (ncsc.gov.uk) — all quoted requirements taken directly from this document; IASME, “The perfect password includes MFA” (iasme.co.uk); NCSC, “Leave passwords in the past — passkeys are the future”, CYBERUK 2026 (ncsc.gov.uk). Requirements verified against the primary NCSC document on 20 July 2026.