We often get asked whether a new password policy will satisfy an insurer. Password rules matter, but they are rarely what coverage depends on. Multi-factor authentication is.
MFA is the condition that matters
Cyber insurers underwrite from claims history, and claims history points at stolen logins. Coalition's 2024 Cyber Claims Report found that 82% of denied claims involved organizations without properly implemented MFA. That is why applications ask about MFA in detail, and why a gap can mean higher premiums, a denied claim or no coverage at all.
Carriers usually expect MFA on remote access, on email, on administrator and other privileged accounts, and often on backup systems.
Password rules matter less than most people think
Carriers rarely require a specific password length, character mix or change schedule. The current federal standard, NIST SP 800-63B Revision 4, finalized in July 2025, has also moved away from the old rules. For accounts protected only by a password, it calls for at least 15 characters, no forced periodic changes unless there is evidence of compromise, no required character mix, and screening new passwords against lists of known breached passwords.
Dropping forced password changes is only safe when the safeguards behind it are actually turned on.
“No rotation” only works with the safeguards
The NIST approach assumes other controls are in place: breached-password screening, limits on repeated failed logins, logging and monitoring, and MFA. Adopting the relaxed rules without those controls gives you the convenience without the protection.
Other rules can override NIST
If your organization takes card payments, PCI DSS 4.0.1 still asks for 12-character passwords with letters and numbers, and 90-day changes for accounts that use a password alone. Some insurance applications also still ask whether passwords expire. Your coverage application and any regulations you fall under are the requirements that bind you. NIST is the foundation underneath them.
What to do
- Turn on MFA for remote access, email, administrator accounts and backups, and confirm it covers everyone.
- Read the security questions on your current coverage application and answer to them first.
- If you move to longer passwords with no forced changes, confirm breached-password screening, failed-login limits and logging are on.
- Check whether card payments or other regulations add their own password rules.