Cyber Essentials Password Policy: The 2026 v3.3 Rules

The most common misunderstanding about Cyber Essentials passwords is that the scheme forces every account onto a 12-character minimum. It does not. Under Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026), you must manage password quality using one of three options — and if you have multi-factor authentication (MFA) switched on, an 8-character minimum is enough. Choosing the right option for each system is the difference between a policy your staff resent and one that passes assessment comfortably.

This guide sets out exactly what the current requirements say, in plain English, so you can write a password policy that will not trip you up at assessment.

The Three Password Quality Options

The requirements state that you must “use technical controls to manage the quality of passwords”, and that this “will include one of the following”:

1. Using multi-factor authentication. Where MFA protects the account, the password element must be at least 8 characters, with no maximum length restriction.
2. A minimum password length of at least 12 characters, with no maximum length restrictions.
3. A minimum password length of at least 8 characters, with no maximum length restrictions, plus automatic blocking of common passwords using a deny list.

That is the whole rule. There is no 14-character tier, and no requirement to apply the same option everywhere — you can use MFA on your cloud services and a 12-character minimum on a legacy on-premise system that cannot support it.

The practical takeaway for most organisations: if you have already enforced MFA properly, your password length obligation is 8 characters, not 12. The effort is better spent making sure MFA coverage is genuinely complete.

Note the phrase that appears in all three options — “with no maximum length restrictions”. If any system in scope caps password length, that is a finding in its own right, regardless of which option you have chosen.

Protecting Against Brute-Force Guessing

Separately from password quality, passwords must be “protected against brute-force password guessing by implementing at least one of”:

• Multi-factor authentication
• Throttling the rate of attempts, so the wait between attempts increases with each unsuccessful try. You should allow “no more than 10 guesses in 5 minutes”.
• Locking devices after no more than 10 unsuccessful attempts

Again, one of three — not all three. MFA satisfies both this control and the quality control simultaneously, which is a large part of why enforcing it well is the highest-leverage move you can make before assessment.

Where MFA Is Not Optional

The requirements are unambiguous on cloud: your organisation must “implement MFA, where available — authentication to cloud services must always use MFA”. There is no availability get-out for cloud services. If your Microsoft 365, Google Workspace, accounting platform or CRM supports MFA, it must be on.

You should also always use MFA for administrative accounts and for accounts accessible from the internet.

The requirements list four types of additional factor to consider:

• A managed or enterprise device
• An app on a trusted device
• A physically separate token
• A known or trusted account

On SMS, the NCSC’s position is pragmatic rather than prohibitive: SMS “is not the most secure type of MFA but still offers a huge advantage over not using any MFA at all”. If a better option is available for your situation, use it — but do not leave MFA off while you deliberate.

The Rules That Surprise People: No Expiry, No Complexity

Cyber Essentials asks you to support users in choosing unique passwords, and two of the listed measures cut directly against habits many UK firms still have baked into their Active Directory:

• “Not enforcing regular password expiry”
• “Not enforcing password complexity requirements”

If your policy still forces a 90-day rotation, or demands an uppercase-number-symbol formula, you are working against the guidance. Both practices push people towards predictable patterns and reuse. The scheme instead points to educating staff about common passwords, promoting the NCSC’s “three random words” approach, and providing usable secure storage such as a password manager.

You do still need “an established process in place to change passwords promptly if you know or suspect a password or account has been compromised” — event-driven changes, not calendar-driven ones.

Device Unlocking Is a Separate, Lower Bar

A frequent point of confusion at assessment. Where a credential exists purely to unlock a device — a phone PIN, a laptop login — the requirement is “a minimum password or PIN length of at least 6 characters”.

But there is a catch worth reading twice: “when the device unlocking credentials are also used for authentication, you must apply the full password requirements”. On a domain-joined laptop, the login is usually doing both jobs, so the full rules apply. The 6-character allowance is narrower than it first appears.

Device unlocking credentials must also be protected against brute force, using the same throttling or lockout options above. Where a vendor does not let you configure this, the requirements permit you to use the vendor’s default setting.

Passkeys and the Direction of Travel

Version 3.3 expanded the definition of passwordless authentication to include FIDO2, and the requirements are explicit that “FIDO2 authenticators are regarded as MFA because user authentication is performed”. Passkeys, biometrics, security keys, push notifications and one-time codes all sit under the passwordless heading.

This aligns with the NCSC’s formal position announced at CYBERUK 2026: it now recommends passkeys as the default login method, and no longer recommends passwords where passkeys are available. For most firms this is a multi-year transition rather than a switch to flip — but if you are rewriting your authentication approach for certification anyway, it is worth building towards passkeys rather than away from them.

A Compliant Password Policy: The Checklist

1. Map every system in scope and record which authentication it uses. Cloud, on-premise, network devices, third-party and support accounts all count.
2. Enforce MFA on all cloud services — this is mandatory, not conditional — plus all administrative and internet-facing accounts.
3. Pick one quality option per system. MFA (8-character password element), 12 characters, or 8 characters plus a deny list.
4. Remove every maximum length cap you find.
5. Pick one brute-force control per system: MFA, throttling at no more than 10 guesses in 5 minutes, or lockout after no more than 10 attempts.
6. Turn off scheduled password expiry and complexity rules, and replace them with three-random-words guidance and a password manager.
7. Set device unlocking to at least 6 characters — and apply full password requirements wherever that credential also authenticates the user.
8. Write down your compromise-response process for prompt password changes.

How Nerdster Helps

Most Cyber Essentials password failures we see are not about length at all — they are gaps in MFA coverage, a forgotten legacy system with a 16-character cap, or an expiry policy nobody has revisited since 2019. We audit every system in your scope, choose the right option for each, and configure it properly in Microsoft Entra ID or your directory of choice.

We take London firms through Cyber Essentials and Cyber Essentials Plus certification end to end, from gap analysis to a first-time pass — and if you want the wider context, our guide to what changed in Cyber Essentials v3.3 covers the MFA, cloud and BYOD updates that land alongside these password rules. Strong authentication also sits behind the human-layer defences we run, such as anti-phishing testing, and it is one of the controls cyber insurers reward with lower premiums.

If you are unsure whether your current password policy would pass, book a free assessment with Nerdster. We will review it against the current question set and tell you plainly what needs to change.

---

Sources: Cyber Essentials: Requirements for IT Infrastructure v3.3, April 2026, National Cyber Security Centre (ncsc.gov.uk) — all quoted requirements taken directly from this document; IASME, “The perfect password includes MFA” (iasme.co.uk); NCSC, “Leave passwords in the past — passkeys are the future”, CYBERUK 2026 (ncsc.gov.uk). Requirements verified against the primary NCSC document on 20 July 2026.