On this page

Password Expiration Screenshot Guide

1. Purpose of this Guide

This artefact proves your company has password expiration policies configured. Cyber Essentials requires this because long-lived, unchanged passwords are ripe targets for attackers. By enforcing expiration, you compel regular refreshes, reducing the chance of old credentials being abused.

2. What You Will Submit

You will need:

  • A screenshot showing the password expiration settings in your environment.

  • The screenshot should display:

    • Password expiration period (e.g., 90 days).

    • Enforcement at the domain or system level.

    • Confirmation that the policy is active, not just a draft.

3. How to Collect / Obtain / Generate This Evidence

Microsoft Active Directory / Entra ID (Azure AD):

  1. Open Group Policy Management → Default Domain Policy → Account Policies → Password Policy.

  2. Locate Maximum password age.

  3. Screenshot the value (e.g., 90 days).

Microsoft 365 (Cloud-only):

  1. Log into Microsoft 365 Admin Center → Settings → Org Settings → Security & Privacy.

  2. Under Password expiration policy, verify days set.

  3. Screenshot this setting.

Google Workspace:

  1. Open Admin Console → Security → Authentication → Password Management.

  2. Check Password expiration period.

  3. Screenshot the setting with applied value.

Other Systems (Okta, OneLogin, etc.):

  1. Go to Security / Policies → Password Policy.

  2. Locate expiration/rotation settings.

  3. Screenshot policy configuration.

4. Evidence Format

  • Accepted file types: PNG, JPG, PDF.

  • Suggested naming format:
    YourCompanyName_PasswordExpiration_YYYY-MM-DD.png
    Example: AcmeCorp_PasswordExpiration_2025-07-01.png

5. What “Good” Looks Like

  • Screenshot shows a specific expiration timeframe (not blank/disabled).

  • Policy scope visible (applies to users or domain).

  • Captured from official admin console (Active Directory, M365, Google Admin, etc.).

Why it matters: auditors want proof that password expiration is not optional — it’s actively enforced across accounts.

6. Tips

  • Pair this with your Password Compromise Screenshot to demonstrate layered defence.

  • Redact user names or tenant IDs from screenshots.

  • Standardise expiration values (e.g., 90 days) across all systems to avoid gaps.