Cyber Essentials password and PIN requirements
Last reviewed 2 November 2026 against the Cyber Essentials requirements v3.3 (Danzell question set).
The exact v3.3 password and PIN table
Sections E.2 (page 16) and E.4 (pages 20–22) of the NCSC Requirements for IT Infrastructure v3.3 set exact technical thresholds depending on what the credential does:
| Scenario | Minimum length | Maximum length restriction | Brute-force protection required |
|---|---|---|---|
| Physical device unlock only (e.g. phone passcode, Windows Hello PIN) | 6 characters (or biometric) | None specified | Lock after ≤10 failed attempts, OR throttle to ≤10 guesses in 5 minutes (or vendor default if unconfigurable) |
| Account password with MFA enabled (mandatory on all cloud services) | 8 characters | No maximum length restriction permitted | Protected by MFA (plus throttling/lockout where supported) |
| Password-only login with an automatic common-password deny list | 8 characters | No maximum length restriction permitted | Lock after ≤10 failed attempts, OR throttle to ≤10 guesses in 5 minutes |
| Password-only login without MFA and without a deny list | 12 characters | No maximum length restriction permitted | Lock after ≤10 failed attempts, OR throttle to ≤10 guesses in 5 minutes |
Why forced complexity and 90-day password expiry are prohibited
Old-fashioned IT policies used to force staff to change their password every 90 days and include an uppercase letter, a number and a symbol. The NCSC stopped recommending that years ago because it makes people pick predictable patterns like Summer2026! followed by Autumn2026!.
Page 22 of v3.3 explicitly requires organisations to support users by:
- Not enforcing regular password expiry (only change a password when there is a known or suspected compromise).
- Not enforcing password complexity requirements (instead, encourage three random words or long passphrases generated by a password manager).
- Providing usable secure storage for passwords: Such as an approved business password manager (for example, 1Password, Bitwarden or Keeper) or a secure locked cabinet for emergency recovery codes, with clear guidance on how to use it.
Passkeys: the v3.3 passwordless upgrade
Version 3.3 highlights FIDO2 passkeys as a stronger alternative to passwords altogether. Because a passkey uses public-key cryptography unlocked by your fingerprint, face or device PIN, it cannot be phished or guessed by brute force, and counts as full MFA under Cyber Essentials.
Download a ready-made v3.3 Passwords, MFA & Passkeys policy in the Evidence pack
Generate editable security policies and asset, admin and cloud registers written for small businesses preparing for Cyber Essentials.
Get the free 9-part Evidence Pack →