Password manager and MFA
Strong, unique passwords and multi-factor authentication (MFA) protect Northwind and our customers' data. This page summarizes the current rules in POL-IT-003 (Passwords and Access), version 2, effective 2026-03-01.
The current rules
| Rule | Current requirement (POL-IT-003 v2) |
|---|---|
| Minimum password length | 14 characters |
| MFA | Mandatory for everyone |
| Password rotation | No forced rotation, except after a suspected compromise |
| Storage | Use the company password manager; never write passwords down |
Version 1 of POL-IT-003 required at least 10 characters and a change every 90 days. That version is superseded. If you see a reminder to rotate your password every 90 days, it is out of date; please tell the service desk.
Set up the password manager
- Open the Software Centre and install "Northwind Password Manager", or use the browser extension.
- Sign in with your Northwind account and approve the MFA prompt.
- Create a master passphrase of at least 14 characters. Use four or more random words.
- Import any saved passwords from your browser, then delete them from the browser.
- Use the generator for every new account: choose 20 characters or more.
Enrol in MFA
- On your phone, install the approved authenticator app.
- On your laptop, open the account security page and choose "Add authenticator".
- Scan the QR code, then enter the six-digit code to confirm.
- Save your recovery codes in the password manager, not on your laptop's desktop.
- Optionally register a hardware security key as a second method.
New hires complete this on day one, see New hire onboarding.
When to change a password
Change a password immediately if:
- You suspect it has been exposed, for example after a phishing email.
- A service reports a breach.
- You shared it by mistake.
Then report the event: see Report an incident. Erin Oduya, the IT Security Manager, owns this policy.
Common mistakes
| Mistake | Better practice |
|---|---|
| Reusing a password across sites | Generate a unique one for each |
| Approving an MFA prompt you did not start | Deny it and report it |
| Storing codes in a notes app | Store them in the password manager |
| Sharing an account | Request separate access, see Request access |
Lost phone
Contact the service desk (Bob Kessler's team). They will verify your identity and reset MFA. Until then you may not be able to reach company systems, including the VPN.
Customer requirements
Some customers require additional controls; the Stellar Health page lists extra requirements for health data.
Owner: Erin Oduya - Last updated: 2026-03-04