SECTION 1 - 3.Y

PASSWORD MANAGEMENT

Password management is a critical component of ensuring the cybersecurity of the Northern Lights Library System (NLLS), and the smooth operation of system services. Poor password management practices increase the organization's vulnerability to malicious cyber activity, which poses a significant risk of lost personal and business data.

1. Employees must use password management software provided by NLLS to ensure the appropriate distribution of access and secure storage of passwords critical to our operations.
2. Employees are required to use the provided software to store and access all business-related passwords. Passwords are not permitted to be digitally stored using alternative password management tools or other digital storage solutions, such as external storage devices. Physical storage of passwords, such as through written notes, is also not permitted.
3. To promote general cyber security and maintain the integrity of the password management system, passwords are not permitted to be shared with individuals outside of the organization under any circumstances. Additionally, passwords are not permitted to be shared within the organization via unsecured platforms such as handwritten notes, email, text messages, or other instant messaging services.
4. Physical password management software recovery tools, in case of lost passwords or system lockouts, are to be solely stored in a safe deposit box owned and controlled by NLLS.
5. Passwords must be complex and generally go beyond the recommendations of the entity requiring login credentials. If password recommendations are not provided, employees must create a complex password of no fewer than eight characters and inclusive of at least one number and one special character. Passwords must also be unique, and not include any words or terms associated with the workplace, such as: NLLS, Elk Point, or company contact information.