Password Policy

1. Purpose

This policy sets minimum security requirements for administrator passwords on the Black X Marketing Inc. website, based on current NIST digital identity guidelines. Since there is no public registration and only employees hold accounts, the focus is on hardening privileged access.

2. Account Eligibility

Administrator accounts are only provisioned for current Black X Marketing Inc. employees. Each account must belong to one named individual — no shared or generic logins. Accounts are deactivated immediately upon termination, role change, or extended leave. New admin accounts require approval from a designated site owner before creation.

3. Password Requirements

• Minimum length: 15 characters; passphrases encouraged

• Maximum length: at least 64 characters accepted

• All printable characters and spaces allowed

• No forced mix of uppercase/lowercase/numbers/symbols required

• No password hints ever stored or shown

• New passwords checked against known breached/common password lists and rejected if matched

• No reuse of passwords from other systems

4. Password Storage — Admins Cannot View Passwords

• Passwords are stored only as salted, one-way cryptographic hashes — never in plaintext or reversible encryption

• Recommended hashing: Argon2id (bcrypt as fallback, work factor 10+)

• A unique random salt (16+ bytes) is applied per password

• Entered passwords are discarded from memory immediately after hashing/verification — never logged or cached

• Because hashing is one-way, no administrator (including super-admins or developers) can ever technically view another admin’s real password — this enforces “update only, never view” at the data level, not just the interface

5. Password Changes and Resets

• Administrators can only change their own password by authenticating first; the system never displays or pre-fills the existing password

• No forced periodic password rotation (e.g., no mandatory 90-day resets)

• A password change is required immediately if: account compromise is suspected, the password matches a breach list, or credentials may have been shared or intercepted

• Resets go through a secure verified channel (e.g., time-limited link to company email) — never manually set by support staff

• New passwords must be meaningfully different from the previous one

6. Authentication Hardening

• Multi-Factor Authentication (MFA) is required for all administrator accounts

• Accounts lock after 10 consecutive failed login attempts

• Login and reset endpoints are rate-limited

• Admin sessions time out after inactivity and use secure, HTTP-only cookies

• Password fields must allow paste/autofill for password managers

7. Logging and Auditing

• All login attempts, password changes, resets, and lockouts are logged with timestamps — passwords themselves are never logged

• Logs are reviewed periodically for unusual login activity

• Admin account creation/deactivation is tracked against employment status

8. Roles and Responsibilities

Employee/Administrator: choose a unique long passphrase, enable MFA, never share credentials, report suspected compromise immediately

Site Owner/IT Lead: approve and provision admin accounts, deactivate on termination or role change, review access logs

Developer/Engineering: implement salted Argon2id/bcrypt hashing, breach screening, MFA, rate limiting, and ensure no code path ever exposes stored passwords

9. Policy Review

This policy is reviewed at least annually, or sooner if security guidance changes, an incident occurs, or the authentication system is updated.