You may notice you are no longer asked to change your password every few months, or to include a specific mix of symbols and numbers. This is intentional — current guidance found that those older rules pushed people toward predictable passwords that were actually easier to guess, not harder.

• Use the company password manager for every account — you should not need to memorize passwords.
• Let the password manager generate a new, random password for each new account.
• Never reuse a password across two different accounts, even personal ones.
• Turn on multi-factor authentication everywhere it is offered, not just where it is required.
• If you ever suspect an account was compromised, change that password immediately and tell IT.

• Why can't I use the same strong password everywhere? — One breach anywhere that password was used exposes every account using it.
• Isn't a password manager itself a risk? — It is protected by one strong master password plus MFA, and is far safer than reusing passwords or writing them down.
• What if I forget my master password? — Contact IT for the organization's approved recovery process — never share it with anyone else.

• Password Manager Guide — /knowledge-center/cybersecurity/password-security/password-manager-guide