For any managed services provider, security is at the top of the list. Managing hundreds of passwords for a range of customers is a daunting task. Ad hoc strategies leave room for errors. That is where NIST guidelines come in.
What NIST is
NIST is a non-regulatory federal agency in the U.S. Department of Commerce. Its Cybersecurity Framework and SP 800-63 publications are widely used beyond federal agencies because they are credible and customizable.
NIST password standards that matter
- Length over complexity theater: eight-character minimum when a person sets the password; allow long passphrases (64+ characters), spaces, and UNICODE.
- Stop forced periodic resets unless there is evidence of compromise. Frequent resets produce weaker passwords.
- Composition rules that are too strict (must include symbol, number, mixed case) often backfire. Users forget them and fall back to weak patterns.
- Show password while typing and allow paste so people can use password managers.
- Drop knowledge-based hints such as pet names. Personal data is too easy to harvest.
- Limit login attempts (NIST suggested a maximum of about 10) to slow brute force without locking out forgetful users immediately.
Related: How to get an ISO 27001 certification. For a program-level review, contact Cyber Security Resource.