Cyber Essentials Password Requirements — NCSC-Compliant 2026 Guide

What Is Cyber Essentials?

Cyber Essentials is a UK government-backed certification scheme administered by the National Cyber Security Centre (NCSC). It defines a baseline set of security controls designed to protect organisations — particularly small and medium enterprises — against the most common internet-based threats.

The scheme covers five technical controls: boundary firewalls, secure configuration, access control (including passwords), malware protection, and patch management. Password controls fall under access control and are one of the most frequently assessed requirements.

There are two certification levels: Cyber Essentials (self-assessment, ~£300) and Cyber Essentials Plus (independently tested, ~£800–1,500). Both require the same password controls on paper, but Plus includes automated testing.

Cyber Essentials Password Requirements

The scheme does not mandate a specific password length or complexity formula. Instead, it requires that:

• Default credentials are changed on all devices and services before deployment
• Passwords are not easily guessable — no common patterns, personal information, or dictionary words
• Account lockout is enabled after a maximum of 10 failed attempts, or MFA is implemented
• Credentials are changed on any indication of compromise
• Unique passwords are used for each system — reuse across services is not compliant

NCSC Password Guidance

The NCSC Small Business Guide provides practical password recommendations that align with and support Cyber Essentials compliance:

• 8+ characters for standard accounts, 14+ for administrator accounts
• Use a password manager to generate and store all work credentials
• Three random words technique for memorable master passwords
• No mandatory rotation — change only on compromise or staff departure
• MFA strongly recommended for important accounts, expected for cloud services

MFA and Cyber Essentials

Multi-factor authentication is effectively required for cloud services, remote access accounts, and administrator accounts under the updated Cyber Essentials scheme (2022 onwards). The technical control requirement — account lockout after max 10 attempts, or MFA — means that for internet-facing systems, MFA is the practical standard.

Password strength alone is not sufficient for cloud and remote access accounts. The combination of a strong generated password and MFA is what Cyber Essentials assessors expect.

For admin accounts, FIDO2 hardware security keys (YubiKey, Google Titan) are the gold standard, but TOTP authenticator apps are acceptable for most SMEs.

How Work Password Helps You Comply

Work Password is a free, client-side password generator and policy builder designed specifically for Cyber Essentials and NCSC compliance. Here is how it maps to the scheme requirements:

• Live compliance panel — the tool checks your password settings against Cyber Essentials, NCSC, and NIST requirements in real time
• Policy paragraph generator — copy a ready-to-use staff handbook paragraph documenting your password policy for Cyber Essentials evidence purposes
• Account-type presets — Standard (16 chars), Admin (20 chars), Cloud (20 chars), and Remote Access (24 chars) with appropriate defaults for each threat level
• Client-side only — all generation uses crypto.getRandomValues(). Nothing transmitted, nothing stored. Safe for generating credentials before importing into your business password manager
• Free — no sign-up, no subscription, no data collection. Built for SMEs without a security consultant budget

Preparing for Your Cyber Essentials Assessment

When preparing your password controls for a Cyber Essentials assessment, focus on these five actions:

1. Deploy a business password manager — Bitwarden Business or 1Password Teams are recommended for UK SMEs. Configure shared vaults with access controls and audit logging.
2. Enable MFA on all cloud services, remote access, and admin accounts. Use authenticator apps or hardware security keys.
3. Document your password policy — use the Work Password Policy Builder to generate a compliant policy paragraph. Include it in your staff handbook.
4. Configure account lockout on all internal systems — 5 failed attempts before temporary lockout is a good threshold below the 10-attempt maximum.
5. Define an off-boarding process — document how credentials are revoked when staff leave, including password manager deprovisioning and shared credential rotation.