Security Policy Generator
Generate SOC 2-ready security policies — customizable and copyable
Policy details
Password requirements
Generated policy
# Your Company — Password & Authentication Policy **Effective Date:** 2026-08-25 **Version:** 1.0 **Owner:** Security Team --- ## 1. Purpose This policy establishes requirements for creating, managing, and protecting passwords and authentication credentials across all systems operated by Your Company. ## 2. Password Requirements All user passwords must meet the following criteria: - **Minimum length:** 12 characters - Must contain at least one uppercase letter (A-Z) - Must contain at least one lowercase letter (a-z) - Must contain at least one number (0-9) - Must contain at least one special character (!@#$%^&*) - Must not contain the user's name, email, or company name - Must not match any of the last 12 previously used passwords ## 3. Password Management - **Password rotation:** Every 90 days for privileged accounts - **Password storage:** Hashed using Argon2id or bcrypt (minimum cost factor 12) - **Password transmission:** Only over TLS 1.2+ encrypted connections - **Password sharing:** Prohibited under all circumstances ## 4. Multi-Factor Authentication (MFA) MFA is **required** for: - All administrative access - Remote access to production systems - Access to systems containing customer data - Privileged accounts (root, admin, superuser) Acceptable MFA methods: - TOTP authenticator apps (Google Authenticator, Authy) - Hardware security keys (YubiKey, FIDO2) - Push notification apps with number verification ## 5. Account Lockout - Accounts lock after 5 consecutive failed login attempts - Lockout duration: 30 minutes (automatic unlock) - Administrative unlock requires identity verification ## 6. Enforcement Violations of this policy may result in: - Immediate password reset - Temporary account suspension - Disciplinary action per company policy ## 7. Review This policy is reviewed annually or upon significant security changes. --- *Generated by Formatho — free, privacy-first developer tools.*
About the Policy Generator
SOC 2 auditors request documented policies for every control area. The three most commonly requested are the Password and Authentication Policy (CC6.1), the Access Control Policy (CC6.2), and the Incident Response Plan (CC7.1-CC7.5). Writing these from scratch takes hours; auditors have seen hundreds and know what they expect.
This generator produces auditor-ready policy templates customized with your company details. The password policy includes MFA requirements and hashing standards; the access control policy covers provisioning, reviews, and deprovisioning; the incident response plan includes severity classification and notification timelines.
How to use
- Enter your company name and effective date.
- Choose the policy type (password, access control, or incident response).
- Customize the parameters to match your actual practices.
- Copy the generated policy and review with your security team.
- Store in your compliance documentation system for audit evidence.
Frequently Asked Questions
Are these policy templates sufficient for a SOC 2 audit? ▾
They cover the core requirements that auditors expect for the three most-requested policies. However, every organization is different — review with your security team and auditor to ensure they accurately reflect your actual practices. Auditors check that policies match reality, not just that documents exist.
How often should policies be reviewed? ▾
SOC 2 expects annual policy reviews at minimum. Best practice is to review after any significant incident, system change, or organizational change. Document the review date and reviewer in the policy footer.
Is this tool free to use? ▾
Yes! This tool is 100% free. No signup, no credit card, no limits. It's part of Formatho's privacy-first developer toolkit.
Is my data safe? Does this tool send data to a server? ▾
Absolutely. This tool runs entirely in your browser. Your data never leaves your device. Zero server-side processing, zero tracking.