Password
A password is a secret string of characters that you type to prove you are the person an account belongs to. Cyber Essentials requires at least 12 characters, or at least 8 with automatic blocking of common passwords, or MFA with a password of at least 8. There must be no maximum length, and guessing must be limited (A7.10, A7.11).
- Term
- Password
- Also known as
- Passcode, Login password
- Category
- Accounts and access
- Requirement area
- 4. User Access Control; 2. Secure Configuration
- Reviewed against
- Requirements v3.3
What does the term password mean in Cyber Essentials?
A password is a secret string of characters that you type to prove you are the person an account belongs to.
How does password apply to Cyber Essentials?
In plain terms
A password works like the combination on a padlock. A longer combination takes longer to guess, and a combination you reuse on every lock is only as safe as the weakest lock.
What Cyber Essentials asks
The password-based authentication part of the NCSC requirements has four parts.
- Quality, asked at A7.11: use one of MFA, "a minimum password length of at least 12 characters, with no maximum length restrictions", or a minimum of 8 characters with no maximum and "automatic blocking of common passwords using a deny list".
- Brute-force protection, asked at A7.10: MFA, throttling to "no more than 10 guesses in 5 minutes", or "locking devices after no more than 10 unsuccessful attempts".
- Support for users, asked at A7.12: teach people to avoid common and reused passwords, promote passwords of at least three words, provide a password manager or secure locked cabinet, and do not enforce regular expiry or complexity rules.
- A process to change passwords promptly if one is known or suspected to be compromised, asked at A7.13.
Default or guessable passwords must be changed on every device (A5.3). Where a PIN or password only unlocks a device, the minimum is 6 characters. Firewall and external service passwords are asked about separately at A4.3 and A5.5.
Common mistakes
- Forcing a change every 90 days, or demanding symbols and capitals. The requirements say not to enforce either.
- A system that caps password length. Every option says no maximum.
- An 8-character minimum without MFA or a deny list, which meets none of the three options.
See the Cyber Essentials password rules and A7.11. Related: passphrase, password manager, multi-factor authentication.
Related terms
- PassphraseA passphrase is a password made of several ordinary words strung together, such as three random words, which is long and hard to guess but easy to remember.
- Password managerA password manager is an app that stores all your passwords in one locked, encrypted place and can create strong new ones for you, so you only need to remember one.
- Multi-factor authentication (MFA)Multi-factor authentication (MFA) is a method of authenticating a user which uses two or more verification factors.
- Passwordless authenticationPasswordless authentication is a method to establish a user's identity that uses a factor other than knowledge, such as FIDO2 authenticators, biometrics, security keys, one-time codes, QR codes or push notifications.
- Privileged accessPrivileged access is any level of access above that of a normal user, such as admin rights that let someone change settings, install software or see everyone's data.
- Service accountA service account is a login used by a program or automated process, rather than by a person, for example the account a backup tool uses to reach your files.
Frequently asked questions
A password is a secret string of characters that you type to prove you are the person an account belongs to.
In the 2026 Danzell question set, password comes up at A5.3, A7.10, A7.11, A7.12, A7.13. Read those questions against the definition above so your answers use the term the way the assessor will.
Password relates to 4. User Access Control; 2. Secure Configuration in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.