USNH Password Policy

On October 28, 2019 the University System of New Hampshire (USNH) enacted a new password policy based on current industry standards. The new, low impact policy applies to employees and students at all USNH applications and campuses.

The new standards call for a password between 14-64 characters with no complexity (for example, it can be all lowercase) and no limits on special characters. Password changes are required annually.

Detailed Password Policy Rules:

  • Passwords shall be between 14 and 64 characters in length with no complexity requirement.
  • Passwords shall not include the user’s first, last, or preferred name, the user’s USNH username, or the user’s USNH ID.
  • Passwords shall not be re-used.
  • New password shall be sufficiently different from previous passwords.
  • Passwords shall contain a minimum of 5 unique characters.
  • Password shall not contain number or character sequences of 4 or more. Examples: abcd, 6789, sTuV
  • Password shall not contain characters repeated 4 or more times. Examples: bbbb, 8888, TttT,&&&&
  • Known compromised or commonly used weak passwords are disallowed.
  • Passwords used for USNH purposes shall not be used for purposes outside of USNH including but not limited to personal banking, Amazon, Netflix, Gmail, etc.
  • Passwords used for accessing USNH information technology resources that require local application accounts for authentication (i.e. those that cannot use USNH username and password to log in) shall not be the same as the user’s USNH password.
  • Passwords shall be treated as sensitive, confidential information.
  • Passwords shall not be shared with anyone, including administrative assistants or supervisors.
  • Passwords shall not be written down or stored on-line in clear text.
  • Passwords shall not be shared in email, chat, electronic forms, or other electronic communication.
  • Passwords shall not be spoken in front of others.
  • Users shall not use the "Remember Password" feature of web browsers to store USNH passwords.
  • Forgotten passwords shall be reset using USNH approved automated mechanisms.
  • Users with forgotten passwords who are unable to reset their password using automated mechanisms must provide verification of identity per approved university process.

Details

Article ID: 2070
Created
Mon 11/4/19 10:40 AM
Modified
Thu 10/7/21 3:39 PM
Applicable Institution(s):
Granite State College (GSC)
Keene State College (KSC)
Plymouth State University (PSU)
University of New Hampshire (UNH)
USNH System Office