Password & authentication policy

1. Purpose

This policy defines HLD Group’s requirements for passwords, multi-factor authentication, and the handling of authentication secrets. It reflects modern authentication guidance, which favours length, screening against known-compromised credentials, and strong second factors over frequent forced complexity changes that harm usability without improving security.

2. Scope

This policy applies to all authentication to HLD Group systems by personnel, contractors, and services, including customer environments under our management subject to any stricter customer requirement.

3. Definitions

• Authenticator — the means by which an identity is verified, such as a password, security key, or passkey
• Multi-factor authentication (MFA) — authentication using two or more independent factors
• Phishing-resistant MFA — authenticators bound to the origin, such as FIDO2/WebAuthn keys and passkeys
• Passphrase — a long, memorable secret preferred over short complex passwords
• Credential stuffing — automated use of breached username and password pairs against other services

4. Password requirements

• Minimum length of 12 characters for user accounts and 16 for privileged accounts, with longer passphrases encouraged
• Screening of new passwords against known-breached and common-password lists, with rejection of matches
• No mandatory periodic expiry in the absence of evidence of compromise; passwords are changed on indication of compromise
• No enforced composition rules that predictably reduce entropy; the full character set including spaces is permitted
• No password hints, no knowledge-based questions as a factor, and no re-use across systems
• Passwords stored only as salted hashes using a memory-hard function, never in plaintext or reversibly encrypted

5. Multi-factor authentication

• MFA mandatory for all remote access, all administrative access, and all access to sensitive or customer data
• Phishing-resistant authenticators required for privileged, administrative, and high-risk access
• SMS and email one-time codes avoided as a primary second factor where a stronger option is available
• MFA enrolment and recovery paths protected to the same standard as the primary factor

6. Secrets, keys, and machine credentials

• Application and service secrets stored in a managed secrets vault with access control and audit logging
• Secrets never committed to source control, embedded in images, or shared over chat or email
• Automated secret scanning in CI to detect and block accidental exposure
• Short-lived, automatically rotated credentials and workload identity preferred over static keys

7. Account protection and lockout

• Rate limiting and progressive delays to resist online guessing
• Protection against credential stuffing, including breached-credential detection and anomaly monitoring
• Session management with idle and absolute timeouts appropriate to sensitivity
• Secure, verified processes for password reset and account recovery that resist social engineering

8. Framework alignment

• NIST SP 800-63B (Digital Identity Guidelines — authentication and lifecycle management)
• ISO/IEC 27001:2022 Annex A control 5.17 (authentication information)
• NIST SP 800-53 Rev. 5 control family IA (Identification and Authentication)
• SOC 2 Trust Services Criteria CC6.1
• PCI DSS v4.0 Requirement 8 where cardholder data is in scope

9. Roles, exceptions, and review

This policy is owned by the CISO. Exceptions require documented CISO approval with compensating controls and an expiry date. It is reviewed at least annually and whenever authentication guidance materially changes.