Policy - Password

Version 1.1 – Aug 25 2026

1 Purpose

To protect Horizon Technologies’ information assets by defining minimum requirements for the creation, use, and management of passwords across all systems and services.

2 Scope

Applies to all Horizon employees, contractors, and third‑party users who access:

Internal corporate systems (e‑mail, HR, finance, etc.)
Production infrastructure and SaaS platforms
End‑user administrative portals

3 Requirements

Control	Requirement
Length	Minimum 8 characters
Complexity	Must contain uppercase, lowercase, number, symbol
Expiration	Change required at least every 90 days
Multi‑Factor Auth (MFA)	Mandatory wherever technically supported (e.g., TOTP, WebAuthn)
Storage	Passwords stored only as salted, adaptive hashes (bcrypt >= 10 rounds)
Transmission	Passwords may be entered only over encrypted channels (TLS 1.2+)

4 Privileged Accounts

Privileged and service accounts must:

Use unique credentials per environment (dev / staging / prod)
Rotate credentials immediately when personnel with access change roles or leave the company

5 Account Lockout & Monitoring

Systems must enforce automated monitoring for brute‑force attempts and trigger GuardDuty or equivalent alerts. (Default lockout after 10 consecutive failures unless otherwise required by the owning system.)

6 Responsibilities

Users – create and maintain compliant passwords; never share credentials.
System Owners – enforce technical controls (length, MFA, logging).
Security Team – audit compliance quarterly and report deviations to the CTO.