Internal Use

Password Policy

Dispel

Document Control

1. PURPOSE AND SCOPE

1.1 Purpose

The purpose of this policy is to establish mandatory rules for creating, using, protecting, and managing passwords and related authenticators (including those used for code signing) for Dispel systems and services.

1.2 Scope

This policy applies to:

• All Dispel employees, contractors, and third parties with accounts on Dispel-managed systems or services.
• All passwords and secret authenticators used to access Dispel corporate systems, the Dispel Zero Trust Engine, production infrastructure, and supporting services.
• Passwords and private keys used for code signing or other security-sensitive operations.

1.3 Regulatory and Framework Alignment

2. POLICY STATEMENTS

2.1 Management Commitment

Management Commitment Statement

Senior Management at Dispel is dedicated to the protection of our information assets, industrial control systems, and Protected Health Information (PHI). We assume full accountability for the effectiveness of our security program, ensuring it is integrated into all business processes and aligned with our strategic goals. To maintain compliance with ISO 27001, IEC 62443, HIPAA, and NIST 800-53, we formally commit to:

• Resource Provisioning: Providing the necessary financial, technical, and human resources to sustain a robust security posture.
• Risk-Based Governance: Approving security policies and overseeing a continuous risk management process that prioritizes both data privacy and operational safety.
• Operational Resilience: Supporting the security of industrial automation and control systems (IACS) to ensure safety and reliability.
• Continuous Oversight: Conducting regular management reviews to evaluate program performance, audit results, and opportunities for improvement.

2.2 Primary Policy Statement

Dispel SHALL ensure that passwords and related secret authenticators are created, used, stored, and managed in a manner that protects against unauthorized access, guessing, disclosure, or misuse.

2.3 Secondary Policy Statement

• Passwords and secret authenticators SHALL be protected as confidential information and SHALL not be shared, reused across unrelated systems, or stored in insecure locations.
• Approved password managers SHALL be used wherever technically feasible to generate and store strong, unique passwords.
• Multi-Factor Authentication (MFA) requirements are governed by the Identification and Authentication Policy and Procedures (P-IdentificationandAuthenticationPolicyandProcedures).

3. REQUIREMENTS

3.1 Password Creation and Complexity

Objective: Ensure passwords are sufficiently strong to resist brute-force and guessing attacks.

Mandatory Activities:

1. Complex passwords SHALL be used wherever technically feasible.
2. Complex passwords SHOULD be at least 14 characters in length when managed via an approved password manager and SHOULD include a mix of upper-case, lower-case, numeric, and non-alphanumeric characters.
3. At minimum, passwords MUST have at least 8 characters on systems where longer passwords are not yet supported.
4. Passwords MUST NOT be based on easily guessable personal data (e.g., date of birth, addresses, names of family members, or other publicly available information).
5. Passwords MUST NOT be commonly used, expected, or found on known compromised-password lists.

Required Outputs:

• Configured password policies on identity providers and critical systems reflecting the above requirements.

Security Controls: NIST SP 800-53 IA-5, IA-6.

3.2 Password Use and User Obligations

Objective: Ensure users handle passwords securely in daily operations.

Mandatory Activities:

1. Users MUST NOT disclose passwords to any unauthorized person, including management and system administrators who do not require the password for a legitimate operational reason.
2. Users MUST NOT write down passwords or store them in plaintext (e.g., email, chat, personal notes, or unencrypted files). If passwords must be stored, they SHALL be stored only in an approved password manager.
3. Users SHALL change passwords if there are indications that a password or system may be compromised and SHALL report a security incident according to the Incident Response Policy.
4. Passwords used for private (non-business) purposes SHALL NOT be reused for business systems.
5. Approved password managers SHALL be used where supported.

Required Outputs:

• Evidence of user training or communication covering password obligations.

Security Controls: NIST SP 800-53 IA-5, IA-2, AC-2.

3.3 Shared Access and Credential Transmission

Objective: Minimize shared secrets and ensure secure credential handling.

Mandatory Activities:

1. Identity and Access Management (IAM) SHOULD be used to provision individual accounts so each user has their own credentialed access to each environment.
2. Where IAM is not available and passwords must be transmitted between workers:
   • Strong encryption methods (e.g., public-key cryptography) or out-of-band channels SHALL be used.
   • Encrypted credentials SHALL still be transmitted only over encrypted transport protocols.
3. Shared passwords SHALL be avoided; where unavoidable, shared credentials SHALL be managed through an approved password manager or SSO mechanism and SHALL be reviewed regularly.

Note: Multi-Factor Authentication (MFA) requirements are defined in the Identification and Authentication Policy and Procedures (P-IdentificationandAuthenticationPolicyandProcedures), which is the authoritative source for all authenticator types including MFA, FIDO2, PKI, and phishing-resistant mechanisms.

Security Controls: NIST SP 800-53 IA-5, AC-2.

3.4 Password Storage and Protection

Objective: Ensure passwords and secret authentication information are stored and handled securely.

Mandatory Activities:

1. All passwords SHALL be treated as confidential information and SHALL NOT be shared with anyone. Requests to share passwords SHALL be denied; instead, the system owner SHALL provision individual access.
2. Users who must maintain their own secret authentication information SHALL receive an initial, unique, and secure temporary password or secret by secure means and MUST change it on first use.
3. Passwords stored by systems SHALL:
   • Be stored with a unique salt.
   • Be stored only as one-way hashes using approved password hashing algorithms (e.g., PBKDF2, bcrypt, scrypt, or Argon2) with appropriate work factors.
4. Temporary passwords SHALL be communicated in a secure manner, and the user’s identity MUST be verified prior to issuance.
5. Password reset or recovery mechanisms SHALL verify user identity (e.g., via registered email or other approved methods) before issuing new secrets.
6. Default passwords provided by software or hardware manufacturers SHALL be changed during initial installation.
7. Approved password manager:
   • Dispel’s approved password manager for workforce use is 1Password.

Security Controls: NIST SP 800-53 IA-5, IA-6.

4. ROLES AND RESPONSIBILITIES

4.1 Policy Owner

Responsibilities:

• Owns this Password Policy and ensures it is reviewed at least annually.
• Ensures password requirements are reflected in identity provider and critical system configurations.
• Coordinates updates to this policy in response to changes in regulations, standards, or risk.

4.2 Security Officer

Responsibilities:

• Defines technical implementation standards for password storage, hashing, and management.
• Monitors for suspected password compromise and coordinates incident response when needed.
• Provides guidance on proper use of password managers and MFA.

4.3 System Owners / Administrators

Responsibilities:

• Configure systems to enforce password complexity, rotation, and lockout policies consistent with this policy.
• Ensure default passwords are changed and shared credentials are minimized.
• Ensure systems store passwords only using approved hashing and salting mechanisms.

4.4 Users (Covered Persons)

Responsibilities:

• Comply with this policy when creating, using, and protecting passwords.
• Use approved password managers where available.
• Promptly report suspected password compromise or unusual account activity.

5. PROCEDURES

5.1 Password Lifecycle Management (High-Level)

6. MONITORING AND COMPLIANCE

6.1 Compliance Monitoring

Compliance with this Password Policy SHALL be monitored through:

• Technical monitoring of authentication events (e.g., failed logins, lockouts, password reset activity) on identity providers and critical systems.
• Periodic access and configuration reviews to ensure password policies and MFA configurations are correctly enforced.
• Internal or external audits that test password management controls.

6.2 Metrics and Reporting

The following metrics SHALL be tracked and, at minimum, reviewed annually by the Policy Owner and Security Officer:

6.3 Non-Compliance Consequences

Failure to comply with this policy may result in:

• Revocation or restriction of system access.
• Disciplinary action for employees and contractors, consistent with Dispel HR policies and applicable law.
• Contractual or access-related remedies for third parties.

7. EXCEPTIONS AND WAIVERS

7.1 Exception Process

Exceptions to this policy SHALL:

1. Be submitted in writing by the requesting party.
2. Include justification and business impact.
3. Describe compensating controls or mitigation measures.
4. Define exception duration and remediation plan.

7.2 Exception Approval Authority

8. DEFINITIONS

Password: A secret value used to authenticate a user to a system.

Multi-Factor Authentication (MFA): An authentication mechanism that requires two or more independent factors (e.g., something you know, something you have, something you are).

Password Manager: An approved tool used to generate, store, and manage passwords securely.

Authenticator: Any secret (e.g., password, token, private key) used to verify identity for access to a system or service.

9. REFERENCES

9.1 Internal References

• Information Security Policy and related standards.
• System Access Control Policy.
• Identification and Authentication Policy and Procedures.
• Secrets Management Standard.

9.2 External References

• NIST SP 800-63 Digital Identity Guidelines.
• NIST SP 800-53 (IA and AC families).
• ISO/IEC 27001 and ISO/IEC 27002 (access control and authentication-related controls).
• IEC 62443 series (where applicable).

10. DOCUMENT HISTORY

11. APPROVAL SIGNATURES

APPENDICES

Appendix A: Supporting Password Procedures

This appendix may include:

• Detailed onboarding and offboarding checklists related to account and password management.
• Step-by-step procedures for password reset, recovery, and MFA enrollment.
• Screenshots or configuration examples for IdPs and password manager settings.

Appendix B: Additional Guidance and Examples

This appendix may include:

• Example strong password configurations and generator settings.
• Sample user communications on password hygiene and MFA.
• References to current industry guidance on password security.