Password Manager Policy Template for UK Businesses (ISO 27001 and ISO 9001)

Document Information

Policy Title: Password Management Policy
Document Reference: [e.g. ISMS-POL-005]
Version: 1.0
Date Issued: [Date]
Next Review Date: [Date + 12 months]
Policy Owner: [Name / Role, e.g. IT Manager / Operations Director]
Approved By: [Name / Role, e.g. Managing Director]

---

1. Purpose and Scope

This policy establishes the rules governing the creation, use, protection, and management of passwords and other authentication credentials at [Organisation Name] (referred to in this document as “the organisation”).

This policy applies to:

• All employees, contractors, and third-party users who access the organisation’s systems, applications, or data
• All devices — including personal devices used to access work systems (BYOD)
• All systems holding organisational or customer data, including cloud-based applications, email platforms, financial systems, and CRM tools

This policy supports compliance with ISO 27001:2022 Annex A.5.17, ISO 9001:2015 clause 7.5, and the UK General Data Protection Regulation (UK GDPR) Article 5(1)(f).

[Guidance: Auditors look for a clear statement of who is in scope. Vague scope — “all staff” without referencing contractors or third-party access — is a common gap. Your password manager’s admin console can enforce policies across all active user accounts, giving you a technical control that mirrors this written scope.]

---

2. Password Requirements

All passwords protecting organisational systems and data must meet the following minimum requirements:

• Minimum length: 14 characters for standard user accounts; 20 characters for privileged/admin accounts
• Complexity: Passwords must not be based on dictionary words, personal information (name, date of birth, company name), or common patterns (e.g. “Password1!”). Use of a password manager-generated random password is the preferred method and satisfies this requirement automatically.
• Uniqueness: Each system must have a unique password. Reusing a password across two or more systems is prohibited.
• Reuse restriction: Passwords must not repeat any of the previous 12 passwords used for that account.
• Expiry: Passwords do not need to be changed on a fixed schedule unless there is evidence of compromise or a change in the user’s role. This is in line with NCSC guidance, which discourages routine expiry in favour of longer, unique credentials. Passwords must be changed immediately upon any suspected or confirmed compromise.
• Sharing: Passwords must never be shared by email, SMS, instant message, or verbally, except through an approved password manager’s secure sharing feature.

[Guidance: The 14-character minimum, prohibition on reuse, and no-fixed-expiry approach all align with current NCSC guidance and are increasingly expected by ISO 27001 auditors over legacy 90-day rotation policies. Tools like 1Password Business and LastPass Business enforce minimum length and complexity at the vault level, and can prevent users from saving weak credentials.]

---

3. Use of a Password Manager

The organisation has approved the use of [Name of Password Manager, e.g. 1Password Business / LastPass Teams] as its designated password management tool.

• All employees are required to use the approved password manager to store and generate credentials for work-related systems.
• The use of browser-based password saving (e.g. Chrome, Edge, Safari built-in password storage) for work accounts is prohibited unless explicitly approved by [IT Manager / Policy Owner].
• All work credentials must be stored in the organisational vault, not a personal vault, unless a personal vault has been explicitly permitted by the Policy Owner for designated use cases.
• The password manager must be protected by a strong master password (meeting the requirements in section 2) and multi-factor authentication (see section 6).

[Guidance: Mandating a specific tool rather than leaving the choice to individuals is best practice. Auditors want to see that the organisation has implemented a technical control, not simply told staff to “use a password manager.” For a deeper look at how password managers map to ISO 27001 controls, see our guide: Password Managers and ISO 27001 Compliance.]

---

4. Privileged and Administrator Account Rules

Privileged accounts — those with elevated access rights such as system administrator, domain admin, or database admin roles — carry a higher risk if compromised and must be subject to additional controls:

• Privileged account credentials must be stored in a dedicated, access-controlled vault or collection within the password manager, visible only to authorised individuals.
• Privileged account passwords must meet the higher minimum length requirement (20 characters) specified in section 2.
• Privileged access must be granted on a least-privilege basis: users should not hold admin credentials unless their role requires it.
• Admin accounts must not be used for routine tasks such as checking email or browsing the web. A separate standard account must be used for day-to-day activity.
• All use of privileged accounts should be logged where technically feasible, and logs reviewed periodically by [IT Manager / Policy Owner].

[Guidance: ISO 27001 Annex A.8.2 covers privileged access rights separately, but password requirements for those accounts are assessed alongside A.5.17. Auditors will often ask to see evidence that admin credentials are stored separately and with higher scrutiny. 1Password Business supports dedicated “Admin” vaults with restricted visibility; LastPass Business offers similar controls via its Admin Console.]

---

5. Shared Accounts and Service Accounts

Where shared accounts are unavoidable (for example, a team social media account, a service account used by automated processes, or a supplier portal accessible by multiple staff), the following rules apply:

• Shared credentials must be stored in a shared vault or collection within the approved password manager, accessible only to those with a legitimate business need.
• Access to shared vaults must be reviewed and confirmed at least every six months, or following any change in team membership.
• When a member of staff with access to a shared account leaves the organisation, or changes role, the shared password must be changed promptly (see section 7).
• Service accounts used by applications or automated processes must be documented in the password manager or a separate service account register, with a named owner responsible for each account.
• Shared personal logins (where one individual’s credentials are shared with colleagues) are prohibited.

[Guidance: Shared accounts are one of the trickiest areas for auditors to assess, because individual accountability is lost. The answer is not to ban shared accounts (that is often impractical) but to demonstrate that they are tracked, time-limited in access, and immediately updated on personnel changes. A team vault in your password manager is the most auditable solution available.]

---

6. Multi-Factor Authentication (MFA)

Multi-factor authentication provides a critical second layer of defence against unauthorised access and is required as follows:

• MFA is mandatory for access to the password manager itself.
• MFA is mandatory for all cloud-based services holding personal or sensitive data, including but not limited to: Microsoft 365, Google Workspace, accounting software, CRM platforms, and any service processing payments.
• MFA is mandatory for all remote access, including VPN, Remote Desktop, and any cloud infrastructure console.
• Where a system does not support MFA natively, this must be reported to [IT Manager / Policy Owner] and an alternative compensating control documented.
• Authenticator app-based MFA (e.g. Microsoft Authenticator, Google Authenticator, Authy) is preferred over SMS-based codes, which are susceptible to SIM-swap attacks.

[Guidance: ISO 27001 A.8.5 covers secure authentication. MFA is increasingly treated as a baseline expectation rather than a bonus control. Cyber Essentials — the UK government-backed scheme — also mandates MFA for cloud services and remote access. 1Password Business and LastPass Business both enforce MFA at login via admin policy, so you can ensure no user can bypass it.]

---

7. Offboarding Procedure

When an employee, contractor, or third-party user leaves the organisation or changes role, the following steps must be completed within [24 hours / one business day] of the effective leaving date:

• The user’s password manager account must be suspended or removed by [IT Manager / Policy Owner], preventing further access to all stored credentials.
• Any shared vault credentials to which the departing user had access must be rotated immediately.
• Any privileged account credentials known to the departing user must be changed, even if stored only in the password manager, to eliminate the risk of memorised credentials.
• Access to all other systems (email, cloud storage, line-of-business software) must be revoked in parallel, following the organisation’s standard joiner/mover/leaver procedure.
• Completion of these steps must be recorded in the organisation’s HR or IT access management log.

[Guidance: This is consistently one of the highest-risk areas identified in ISO 27001 audits and UK GDPR assessments. Credentials not revoked promptly after a departure represent a live data breach risk. A password manager simplifies this significantly — revoking a user from the admin console removes their access to all shared vaults in a single action. For a practical guide on deploying this process, see: How to Roll Out a Password Manager in Your Business.]

---

8. Incident Response — Compromised Credentials

If a user suspects or discovers that a password or set of credentials has been compromised, the following steps must be taken immediately:

1. Do not delay. Report the suspected compromise to [IT Manager / Policy Owner / [email protected]] immediately — even outside business hours if the system involved holds personal or financial data.
2. Change the affected password immediately via the password manager. Use a newly generated random password.
3. Review for reuse. If the compromised password was (in breach of this policy) used elsewhere, change it on all affected systems.
4. Check for active sessions. Where the system permits, review active sessions and force logout of all sessions other than the current one.
5. Document the incident in the organisation’s information security incident log, including the date, systems affected, likely cause, and actions taken.
6. Assess for UK GDPR reporting obligations. If personal data may have been accessed as a result of the compromised credentials, the incident must be assessed for ICO reporting under Article 33 UK GDPR (72-hour notification window).

[Guidance: ISO 27001 A.5.26 and A.5.27 cover incident response and learning from incidents. Auditors look for a clear, documented response process — not perfection, but demonstrable structure. Having this in your password policy, rather than a separate document buried in a file share, means it is in front of users when they need it most.]

---

9. Review Frequency

This policy will be reviewed:

• Annually, on or before the date shown in the document information section
• Following any significant change to the organisation’s IT infrastructure or cloud service landscape
• Following any password-related security incident
• Following any relevant change to UK GDPR guidance, NCSC guidance, or ISO 27001 controls

The Policy Owner is responsible for initiating and documenting each review. Version history must be maintained below.

[Guidance: ISO 27001 and ISO 9001 both require that documents are kept current. An annual review cycle is the minimum expectation. Noting the trigger events for out-of-cycle reviews demonstrates a mature, responsive approach to policy governance.]

---

10. Policy Owner and Approval

This policy is owned by [Name / Role] and was approved by [Name / Role, e.g. Managing Director / Board] on [Date].

Queries regarding this policy should be directed to [Email address / Name].

All staff are required to confirm they have read and understood this policy as part of their onboarding process and following each annual review. Confirmation records are maintained by [HR / IT Manager].

[Guidance: A named owner and a documented approval trail are both required under ISO 27001 and ISO 9001. If your policy has no named owner and no record of who approved it, it is unlikely to pass an audit. Many organisations link this to an annual staff sign-off exercise — a password manager admin portal can support this by showing which users have accepted updated policies if the tool supports it.]