Cyber Essentials Password Policy: Lessons From ‘Password1’

A test account. A password of Password1. Twelve years without anyone noticing.

That is how a ransomware attack got into a Welsh public body’s network, according to two reprimands the ICO announced on 20 October 2026. Personal data belonging to 3,300 people was taken. Most of them were children.

If you run an accountancy practice, a law firm or a factory, the uncomfortable question is simple. Could the same thing be sitting in your systems right now?

A Cyber Essentials password policy is one of the cheapest fixes there is. This guide explains what the current rules require and what the Password1 case teaches about the parts most firms miss. You also get a policy template and a 30-minute checklist to use this week.

What happened in the Password1 case?

The ICO reprimanded two organisations. One was Data Cymru, which helps public bodies across Wales use data. The other was Ogi Networks, its IT provider.

Here is what the ICO found:

• In January 2012, the IT provider created a test account called Test2, with the password Password1.
• Nobody needed the account. Nobody removed it. A password checker rated the password as crackable in under a second.
• On 1 November 2024, attackers used it to get in. They took 42GB of data and encrypted 182.7GB.
• Three systems kept the same local administrator password for over 12 years, which made it easier to move from one to the next.
• There was no compliant data processing contract between the two organisations until April 2025.

David Doodson, the ICO’s Head of Investigations, put it bluntly: “Password1 is not an appropriate password, it is a wide-open door to nefarious actors.”

He also said something every business owner should note: “The responsibility for these failures did not sit with one organisation alone.” The client and the IT provider were both reprimanded.

What does Cyber Essentials require for passwords in 2026?

The current standard is Cyber Essentials Requirements for IT Infrastructure v3.3, used with the Danzell question set. According to IASME, it applies to assessment accounts created after 26 April 2026.

The password rules sit under the user access control section. In plain English:

The rules go beyond the password itself. Every user needs unique credentials. Accounts must be removed or disabled when they are no longer needed, including third-party accounts. Admins must use separate accounts for admin work only, not for email or browsing.

That last group of rules is exactly where the Password1 breach happened.

Does Cyber Essentials follow NCSC password guidance?

Yes. The scheme is run with the NCSC, and the password rules reflect NCSC password guidance. That is why you will not find a rule demanding a capital letter, a symbol and a change every 90 days.

Long, memorable passwords made of several words beat short, complex ones that people write on sticky notes. A password manager stops staff reusing the same password everywhere.

v3.3 also recognises passwordless sign-in. Passkeys (FIDO2 authenticators) count as MFA. For most firms on Microsoft 365, MFA does the heavy lifting. Where MFA uses a password, that password still needs at least 8 characters.

Why do password policies fail in practice?

Most firms have some kind of password policy. The breaches happen in the accounts the policy forgot. These four come up again and again:

1. Leavers. Someone leaves, but their account stays open because their mailbox holds client emails.
2. Test and setup accounts. Created by an engineer during an install, then forgotten. Test2 lasted 12 years.
3. Supplier accounts. Remote access for your IT provider, your accounts software vendor or your machine maintenance firm.
4. Shared admin passwords. One local admin password copied across every PC, so one compromised machine unlocks the rest.

Picture a 25-person accountancy practice in Chester. A trainee left in 2024. Her Microsoft 365 account was never disabled, because a partner still checks her old inbox. MFA was never set up on it, because she left before the rollout. That account is now the softest way into every client file the practice holds. (This is an illustrative example, not a real client.)

Or picture a manufacturer on the Wirral with a shared login on the shop floor PC, used by every shift for five years. Nobody knows who has the password, so nobody can change it without stopping production.

What should a Cyber Essentials password policy include?

You do not need a 20-page document. A clear one-page policy that people follow beats a long one nobody reads. Use this as a password policy template:

1. Scope. Every user, device, cloud service and supplier account. Name the systems, for example Microsoft 365, your practice management software and your remote access.
2. MFA. Required on all cloud services and all admin accounts. Passkeys or an authenticator app preferred.
3. Length. At least 12 characters, or at least 8 where MFA is on. No maximum length.
4. Blocked passwords. Common and previously breached passwords are blocked automatically.
5. Lockout. Accounts lock or throttle after no more than 10 failed attempts.
6. No forced expiry. Passwords change only when there is a reason to suspect compromise.
7. Password manager. The firm provides one. Staff do not reuse work passwords anywhere else.
8. Accounts. Leavers disabled on their last day. Test, temporary and supplier accounts reviewed every quarter.
9. Admins. Separate admin accounts, unique local admin passwords on every device.
10. Ownership. A named owner, a named IT contact and a review date at least once a year.

Want a password policy example in action? Item 8 is the one that would have stopped Password1. It is also the one most often missing.

Who is responsible: you or your IT provider?

Both. That is the clearest lesson from the ICO’s findings. Data Cymru was reprimanded partly because it had no proper contract with its IT provider and had not documented who would monitor and audit accounts.

If an outside firm manages your IT, ask them these five questions:

• Can you send us a list of every account on our systems, including yours?
• Which accounts have not signed in for 90 days, and why do they still exist?
• Is MFA switched on for every Microsoft 365 user and every admin account?
• Does each device have its own local admin password?
• Does our contract say who creates, reviews and removes accounts?

If your answers are vague, that is worth fixing before your next renewal. Our guide to how co-managed IT support splits responsibilities covers how to put this in writing when you have an in-house IT person as well.

A 30-minute password and account checklist

Block out half an hour with whoever looks after your IT and work through this list:

• ☐ Export a list of all user accounts from Microsoft 365 or your main system.
• ☐ Tick off every name against your current staff list.
• ☐ Disable any account belonging to someone who has left.
• ☐ Flag any account called test, temp, admin, scanner or similar. Ask who owns it.
• ☐ Check MFA is on for every user, not just most of them.
• ☐ List every supplier with remote access and when they last used it.
• ☐ Confirm admins have separate admin accounts.
• ☐ Write down a date to do this again in three months.

Most firms find at least one surprise. Better you find it than an attacker does.

Frequently asked questions

Is MFA mandatory for Cyber Essentials?

Yes, for cloud services. Under v3.3, authentication to cloud services must always use MFA, and IASME says missing it is an automatic fail.

Does Cyber Essentials require passwords to change every 90 days?

No. The requirements say you should not enforce regular password expiry. Change a password when you know or suspect it has been compromised.

What is the minimum password length for Cyber Essentials?

12 characters, or 8 characters if you also block common passwords automatically. Where a password is part of MFA, it needs at least 8 characters. There should be no maximum length.

Does an Office 365 password policy meet Cyber Essentials?

It can, but check it rather than assume. Microsoft 365 is a cloud service, so MFA is required for every user. Ask your IT provider to confirm the length, lockout and banned password settings against the table above.

Want a second pair of eyes on your accounts?

Cirrus is Cyber Essentials certified, and we help firms across Cheshire, the Wirral, Liverpool and North Wales get ready for theirs. Want a free, no-obligation IT review call? We will help you spot dormant accounts, missing MFA and other quick wins. Just get in touch or call 0330 313 0966. You can also read more about our cyber security services for small business.

Related reading

• Microsoft 365 for professional services firms: are you actually using it?
• Co-managed IT support: how it works, costs and what to expect