It’s up to your organisation to define what constitutes a ‘strong’ password. But essentially, the overall consensus is that passwords used on IT systems, electronic devices or online accounts should be ‘hard to guess’. This means avoiding using words that have a personal connection to the individual creating the password (e.g. name of a pet, first school or favourite film). This is because personal information can potentially be located without much effort.

The National Cyber Security Centre also recommends adopting the ‘three random words’ approach. This is a memorable way of making a random password by selecting any three words (e.g. ‘redtelevisionshoe’). Although it may seem less complicated in nature, the logic is that three words are harder to guess than one long word.

However, to answer the questions set out by the DSPT you need to be able to make sure that everyone who accesses your organisation’s information adheres to good practices. This can be difficult to evidence without defining more specific instructions. So another method of creating hard-to-guess passwords is to utilise:

• A minimum number of characters
• A mixture of uppercase and lowercase characters
• A mixture of letters, numbers and special characters (e.g. !, £, $)

An example that uses all of the above could be: red5Televisionshoe$

Communicating set requirements such as these in a policy will help your staff, directors, volunteers and trustees create memorable but hard-to-guess passwords. You can clearly describe these practices in your assessment to demonstrate your organisation’s commitment to data protection.