Password Standard

UNIVERSITY AT ALBANY

Information Technology Services

Password Standard

Technical Standards

[Applicable System, Platform, or Domain]

Version:	1.0
Effective Date:	May 29, 2026
Owner(s):	Information Security - Identity and Access Management
Classification:	Internal
Parent Policy:	Information Security Policy

Password Standard

Purpose

To define the technical and operational requirements for password creation, use, storage, and management that implement the authentication requirements of the University at Albany Information Security Policy.

Responsible Office

Information Technology Services, Division for Finance and Administration

Responsible Owner(s)

Information Security - Identity and Access Management

Standards History

Date of Initial Draft: 06/18/2026
Date of Approval: 06/24/2026
Date of Amendments: [Date — or None]

Standards Statement

This standard establishes minimum password requirements for University‑managed systems and accounts to reduce the risk of unauthorized access. It applies to centrally managed and departmental systems that rely on passwords for authentication. This standard supports the University’s Information Security Policy and may be updated by its owners to address emerging threats or changes in authentication technology, provided such updates remain consistent with policy intent.

Persons Affected

This standard applies to all Faculty, Staff, Students, Affiliates, Contractors, Consultants, and Guests who use University‑issued accounts or systems.

Definitions

University is the University at Albany, State University of New York.

Accounts are a unique identity issued by the University that enables access to University systems or data.

Password is a memorized secret used to authenticate an account.

Multi‑Factor Authentication (MFA) is an authentication using two or more factors (e.g., password plus device or biometric).

Privileged Account is an account with elevated permissions such as system administration or security configuration rights.

Compromised Credential is a password known or reasonably suspected to have been disclosed, stolen, or successfully guessed by an unauthorized party.

Standards

The University is committed to protecting accounts and information assets by enforcing strong password practices and modern authentication controls aligned with industry guidance (e.g., NIST SP 800‑63B).

Scope.
This standard applies to all University‑managed systems that authenticate users using passwords, including but not limited to:
1. Central identity authority and directories
2. Cloud services integrated with University identity systems
3. Departmental servers, applications, and databases
4. Privileged, service, and administrative accounts
Password Creation Requirements.
1. Passwords must be at least 16 characters in length.
2. Your password MUST contain at least one character from each of the following categories
  1. lowercase letter (a, b, c, ... through z)
  2. uppercase letter (A, B, C ... through Z)
  3. number (0, 1, 2 ... through 9)
  4. special symbol ( ~ ` ! @ # $ % ^ & * - = + ( ) [ ] { } | \ : ; ' " , < . > / ? )
3. Users are encouraged to create passphrases that are easy to remember and hard to guess.
4. Passwords must not:
  1. Contain the user’s username or NetID
  2. Contain easily guessable personal information (e.g., name, birthdate, University name, phone number, email)
  3. 4 or more of the same character in a row
  4. a special symbol { as the first character
  5. any spaces or accented letters
Password Change and Expiration.
1. Routine password expiration must not be enforced for basic user accounts unless required by system limitations, contractual obligations, or regulatory requirements documented by Information Security.
2. Passwords must be changed immediately when:
  1. The password is suspected or confirmed to be compromised
  2. Directed by Information Security due to a security incident
Multi‑Factor Authentication (MFA).
1. MFA must be enforced for:
  1. Remote access to University systems
  2. Access to systems containing sensitive or restricted data
  3. Privileged and administrative accounts
  4. Accounts with a password of less than 16 characters
2. Password‑only authentication is not sufficient for high‑risk access scenarios.
3. MFA methods and configurations must be approved by Information Security and implemented in accordance with University authentication architecture.
Password Storage and Transmission.
1. Passwords must never be stored in plaintext.
2. Systems should store passwords using strong, salted, one‑way cryptographic key‑derivation or hashing algorithms (for example, PBKDF2, scrypt, bcrypt, or Argon2) approved by Information Security.
3. Passwords must not be transmitted or shared via email, chat, or other insecure channels.
4. Password hashes and associated secret material must be protected as sensitive data and must not be exported or shared outside authorized authentication components.
Password Reuse and Sharing.
1. Passwords used on University systems must not be reused on non-University systems
2. Password sharing is strictly prohibited, including:
  1. Sharing between users
  2. Shared administrative passwords where individual accountability is required
Account Lockout and Throttling
1. Systems must implement protections against brute‑force attacks, such as:
  1. Login attempt rate limiting
  2. Temporary account lockout after repeated failed attempts
2. Lockout thresholds must balance security with denial‑of‑service risk.
3. Lockout and throttling configurations must follow thresholds documented by Information Security to balance usability and protection against automated attacks.
User Responsibilities
1. Users are responsible for:
  1. Protecting their passwords from disclosure
  2. Reporting suspected credential compromise immediately
  3. Using University‑approved password management tools where available
  4. Avoiding reuse of University passwords on personal or third‑party sites.
  5. Being vigilant for phishing or social engineering attempts that request passwords and reporting them to Information Security.
Incident Response.
1. When credential compromise is suspected or confirmed, Information Security may immediately disable affected accounts, require password resets, and enforce MFA re-registration as needed.
2. System owners must cooperate with Information Security to collect logs, contain the incident, notify affected users where appropriate, and restore secure operations.
3. Incident handling must follow the University Information Security Incident Response procedures.