TCR-IT-002: Password Creation & Management Policy
Summary
Section titled “Summary”Standards for creating, managing, and protecting passwords used to access TCR’s information systems (email, LMS, SIS, and other platforms). Applies to all students, faculty, staff, and anyone else accessing TCR’s information systems.
Why it exists
Section titled “Why it exists”Passwords are a primary line of defense against unauthorized access to TCR’s systems and data. This policy reduces the risk of brute-force, guessing, and phishing attacks by setting consistent minimum standards across every system, rather than leaving password strength up to individual users or systems.
Policy
Section titled “Policy”Password creation
Section titled “Password creation”- At least 8 characters, combining upper and lower case letters, numbers, and special characters.
- Must not include personal information (names, birthdays, common words/phrases).
- Different systems and services must have unique passwords, so a breach on one system doesn’t compromise another.
Password management
Section titled “Password management”- Changed at least once per school year; previous passwords can’t be reused within a year of being changed.
- Not written down or stored insecurely. Any password manager in use must be approved by the Office of Information Technology.
- Not shared. If a temporary password must be shared, use a secure method and change it immediately after use.
Password protection
Section titled “Password protection”- Accounts lock after 5 unsuccessful login attempts, unlocking automatically after 30 minutes (or sooner via the Office of Information Technology).
- Passwords must never be transmitted in plaintext over unsecured channels.
Multi-factor authentication (MFA)
Section titled “Multi-factor authentication (MFA)”- Enabled where possible, and required for critical systems including email, LMS, and financial records.
Enforcement
Section titled “Enforcement”The Office of Information Technology monitors compliance through regular audits and security assessments. Non-compliance may result in disciplinary action, including revocation of access rights and, in severe cases, termination or expulsion.
All TCR community members receive training on this policy as part of security awareness education.
Review
Section titled “Review”Reviewed annually and updated as needed to reflect changes in security threats, technology, and best practices.
Digitized from TCR-IT-002 - Password Creation & Management Policy [Rev 1.0].docx; the original is kept under source/policies/ in this repo.