Improved Campus Password Standards

In order to protect individual and University information and resources, the Technology Council recently adopted more rigorous standards for network account passwords. These standards will help ensure that the university network and data on campus computers are secure. The following standards for new passwords are effective as of January 2, 2007.

Passwords must:

• be a minimum of eight (8) characters in length.
• be memorized; if a password is written down it must be stored securely.
• contain at least one (1) character from three (3) of the following categories:
  • Uppercase letter (A-Z)
  • Lowercase letter (a-z)
  • Digit (0-9)
  • Printable special characters (~`!@#$%^&*()+=_ {}[]\|:;”’/?<>,.(space))
• be private and not shared with anyone.
• not contain your proper name or username.
• be changed at least every six months.
• not be reused for at least ten password changes.

Exceptions: Data Custodians

Special Note to Macintosh Users: Anyone using Outlook 2001 (OS 9 Classic Mode) as their mail client must choose a password that is no more than 14 characters in length. Otherwise, all other password standards apply.

Implementation of New Standards

New password standards will be implemented according to the following schedule. This approach should cause the least disruption to users and allow help desk staff to effectively assist with any issues.

• As of January 2, 2007, the improved password standards will go into effect for all new passwords that are created. Any existing passwords will not be affected.
  
• Beginning in February, we will gradually expire passwords based on how long they have been in effect. Initially, passwords that are older than 7 years will be expired. Every two weeks, the age will be reduced until there are no passwords older than six months. This process should be completed by May, 2007.
  
• Users will be notified via email two weeks before their passwords are due to expire, with daily notifications thereafter. In addition, pop-up notifications will appear on campus Windows PC beginning two weeks prior to the password expiration date.

What will Happen if my Password Should Expire?

The following describes how expired passwords will be handled.

• If you attempt to log into a campus Windows PCs and your password has expired, you will be prompted with a dialog box that will allow you to change your password. You must provide your old password in the process.
  
• Students may use the Online Password Reset web page to change their password. You must provide your 9-digit Campus ID, the last four digits of your Social Security number, and your birthdate. (This online password reset function is currently not available for faculty and staff. ) Students on campus can also approach the General Access lab consultants and present a picture ID to have their passwords reset. Students who are having difficulty changing their password should call the CIT Help Desk at (920) 465-2309 between 8 a.m. and 4:30 p.m. Monday-Friday.
  
• Faculty, staff, or students may come to the CIT Help Desk in IS 1150 and show identification to have their password reset.
  
• Faculty and staff who are away from campus must contact the CIT Help Desk if their password has expired. You will be required to provide sufficient personal information to enable us to verify your identity, including your 9-digit Campus ID. Individuals not able to provide this personal information will need to contact their department director or chair to assist in verifying their identity.

Additional Info: Changing your password | Managing your password