Password Management Policy

Weak and reused passwords are a leading cause of unauthorized access to University systems and data. This policy sets minimum password length and multi-factor authentication requirements to reduce that risk, and replaces outdated password rotation and composition practices with current authentication security standards.

This policy applies to all faculty, staff, students, contractors, and vendors who hold credentials for University technology systems, including email, administrative and enterprise resource planning systems, the learning management system, and any other system that requires University authentication. It does not apply to personal accounts that are not connected to University systems.

Authorized Users. Faculty, staff, students, contractors, and vendors with credentials to University systems must create passwords that meet the minimum length standard, enroll in an approved multi-factor authentication method, and report suspected credential compromise to IT Security immediately.

Center for Information Technology. CIT configures University systems to enforce the password and multi-factor authentication standards in this policy, maintains the approved multi-factor authentication methods list in the BCU Technology Standards document, and investigates reports of suspected credential compromise.

Bethune-Cookman University requires every account used to access University technology systems to be protected by a password that meets the minimum length standard in this policy and by multi-factor authentication using a method approved in the BCU Technology Standards document. Passwords must be changed at least once every twelve months. When an account is compromised, the password must be changed immediately, and the same immediate change requirement applies when the Center for Information Technology directs a reset following a confirmed security incident. Users are responsible for safeguarding their credentials and for reporting suspected compromise to IT Security without delay.

Violations of this policy, including circumventing password or multi-factor authentication requirements, may result in loss of system access, disciplinary action, or other consequences consistent with University policy and applicable law. The Chief Information Officer has the authority to enforce this policy.