Does ISO 27001 require 90-day password rotation?

No. ISO 27001:2022 does not mandate a fixed rotation interval. Control 5.17 requires authentication information to be allocated and managed through a formal process, which may be risk-based rather than calendar-based. Forced rotation at short intervals is widely considered to weaken passwords by encouraging predictable increments.

Is this template suitable for a Stage 2 audit?

It gives you the documented policy clause and its control mapping. An auditor will also expect evidence that the policy is applied, reviewed and enforced, so pair the clause with configuration screenshots, an approval record and a review date.

ISO 27001 Password Policy Template — Free, Auditor-Ready (2026)

Q: What is the minimum password length for ISO 27001?

The standard does not state a number. Auditors assess whether the policy is appropriate to the risk. In practice 12 characters for standard accounts and 16 for privileged accounts is the common benchmark, and NCSC guidance favours length over forced complexity.

Configure

Organisation size

Affects how much of the policy is delegated to line managers.

Multi-factor authentication

Annex A 8.5 treats MFA as the primary control for secure authentication.

Minimum length — standard accounts

Minimum length — privileged accounts

Rotation approach

ISO 27001:2022 does not mandate a fixed interval. Risk-based is generally the stronger position.

Service and non-human accounts

Organisation name

Policy owner (role)

Generated clause

What this template covers

A password policy fails an ISO 27001 audit for one of two reasons: it does not exist as a documented control, or it exists but nothing shows it is applied. This template fixes the first. The clause it produces states the requirement, names the control it satisfies, and gives the auditor a review date and an owner to chase.

Control mapping

Annex A control	What the auditor looks for
5.15 Access control	A documented rule set for who may access what, and how access is granted.
5.16 Identity management	Identities are created, verified and removed through a controlled process.
5.17 Authentication information	Passwords and other secrets are allocated, stored, rotated and revoked under formal rules.
5.18 Access rights	Rights are reviewed at a defined interval and removed on leaver events.
8.2 Privileged access rights	Administrative accounts are separated, restricted and held to a stricter standard.
8.5 Secure authentication	Authentication is appropriate to the risk — multi-factor wherever it is practical.

Why there is no fixed rotation interval

ISO/IEC 27001:2022 does not prescribe 90-day rotation, and neither does NIST SP 800-63B. Both favour a risk-based approach: change a credential when there is evidence of compromise, when someone with knowledge of it leaves, or when the system it protects changes classification. Forced rotation at short intervals tends to push people towards predictable seasonal increments, which is worse than a strong password left in place.

If your certification body still expects periodic rotation, choose the 90-day option above. You are allowed to be stricter than the standard. What you cannot do is leave the requirement unstated and hope the auditor assumes it.

What the auditor will ask for beyond the clause

A dated approval record showing management signed the policy off.
Configuration evidence that the identity provider enforces the stated minimum length and MFA scope.
A sample of leaver tickets showing access was removed.
A review log proving the policy is examined on the stated cycle, even if nothing changed.

Related guidance on this site

Frequently asked questions

Annex A 5.17 (Authentication information) is the primary control, supported by 5.16 (Identity management), 5.18 (Access rights), 8.2 (Privileged access rights) and 8.5 (Secure authentication). A password policy needs to show evidence against each of these, not just 5.17.

No. Neither ISO 27001:2022 nor NIST SP 800-63B mandates a fixed rotation interval. Control 5.17 requires authentication information to be allocated and managed through a formal process, which can be risk-based. Short forced intervals are widely held to weaken passwords by encouraging predictable increments.

The standard does not state a number; the auditor assesses whether your policy is appropriate to your risk. In practice 12 characters for standard accounts and 16 for privileged accounts is the common benchmark, and NCSC guidance favours length over forced complexity.

It provides the documented clause and its control mapping. A Stage 2 auditor will also expect evidence the policy is applied and reviewed, so pair the clause with identity-provider configuration screenshots, a management approval record and a review date.

Yes. Adapt it freely inside your own organisation's information security management system. It is a starting document, not certification advice, and it does not replace a gap assessment against the full standard.