# Best practices for Control Center passwords

Passwords are a critical aspect of cybersecurity and can serve as the first line of defense in preventing unauthorized access to your account. They help to protect access to sensitive and proprietary information. This prevention ensures that data and private or sensitive information is used only by the appropriate users.

To ensure secure passwords, the Control Center has implemented a strong list of requirements. While passwords may seem inconvenient, they are an important protection that should be taken seriously.

# Password requirements

<Table align={["left","left"]}>
  <thead>
    <tr>
      <th>
        Requirement
      </th>

      <th>
        Things to consider
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        Cannot be the same as your current password
      </td>

      <td>
        Do not reuse any of your previous six passwords.
      </td>
    </tr>

    <tr>
      <td>
        Cannot be an exact match for any attribute values in your user profile
      </td>

      <td>
        Avoid using your first or last name or your user ID.
      </td>
    </tr>

    <tr>
      <td>
        Cannot be too similar to your current password
      </td>

      <td>
        Do not simply add a number or character to your current password; the new password must be unique.
      </td>
    </tr>

    <tr>
      <td>
        Cannot be a commonly-used password
      </td>

      <td>
        Avoid things like "Password" or "Welcome123".
      </td>
    </tr>

    <tr>
      <td>
        Must have a minimum of 12 and a maximum of 255 characters
      </td>

      <td>
        Longer passwords are harder to hack.
      </td>
    </tr>

    <tr>
      <td>
        Must contain at least one of the following special characters: `~!@#$%^&\*()-\_=+\[]{};:.,\<>/?`
      </td>

      <td>
        Only one special character is required, but consider using more than one for a stronger password.
      </td>
    </tr>

    <tr>
      <td>
        Must contain at least one numeral: `0123456789`
      </td>

      <td>
        Avoid four or more sequential numbers such as 1234.
      </td>
    </tr>

    <tr>
      <td>
        Must contain at least one upper case character:\
        `ABCDEFGHIJKLMNOPQRSTUVWXYZ`
      </td>

      <td>
        Avoid four or more sequential letters such as ABCD.
      </td>
    </tr>

    <tr>
      <td>
        Must contain at least one lower case character:\
        `abcdefghijklmnopqrstuvwxyz`
      </td>

      <td>
        Try alternating upper and lower case letters.
      </td>
    </tr>
  </tbody>
</Table>

## Additional password guidelines

In addition to the requirements, also consider the following guidelines when creating your password.

* Do not use the name of a pet, family member, product, sport, or organization.
* Do not use phone numbers, addresses, birthdays, or other identifying numbers.
* Never use simple adjacent keyboard combinations (e.g., asdfjkl;).
* Do not use palindromes (words or phrases that read the same forward and backwards, for example madam, kayak, nurses run, race car).
* Do not use spaces. If a system improperly handles spaces, it might be more vulnerable to certain types of attacks.
* Do not use the same password for more than one account.
* Do not write your password down or store it near your computer or desk. Use an approved password management tool, if available.

# Password policy rules

* 6 prior passwords are maintained in the password history count for a maximum of 365 days
* The password expires every 90 days (every 3 months)

# Account lockout rules

* Account lockout occurs after 6 distinct failed attempts (repeated attempts of the same password are not counted)
* Locked accounts due to failed password attempts are automatically unlocked after 30 minutes

# Tips for creating a unique password

The key to creating a hard-to-hack password is to make it unique and easy to remember but hard to guess.

Here are some tips to create easy-to-remember but hard-to-guess passwords:

<Table align={["left","left"]}>
  <thead>
    <tr>
      <th>
        Try this...
      </th>

      <th>
        Examples...
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        Relate the password to something you can easily remember, for instance a favorite hobby or vacation destination.
      </td>

      <td>
        "I love to be in Italy" could be changed to "1luv2bn1talE!". It is secure and memorable.
      </td>
    </tr>

    <tr>
      <td>
        Use a phrase you know well but incorporate shortcuts or acronyms.
      </td>

      <td>
        "One for all and all for one" (from *The Three Musketeers* written by Dumas) can be changed to\
        "14A\&a41duMas".
      </td>
    </tr>

    <tr>
      <td>
        Use the first letter of a phrase that is meaningful to you but incorporate symbols or acronyms.
      </td>

      <td>
        "I love my children and they are the best part of me." could be changed to "1Lmc\&TRtbpom!"
      </td>
    </tr>
  </tbody>
</Table>