Passwords and MFA: Where NCSC Advice and PCI DSS Meet

Almost every password policy we see in the field was written from advice that is now obsolete. Change your password every 90 days. Eight characters minimum. Must contain a capital, a number and a symbol. Every one of those rules was standard guidance a decade ago, and the National Cyber Security Centre now advises against two of them outright. Meanwhile PCI DSS still contains a 90-day rule, which leaves UK merchants apparently caught between their national cyber authority and their card scheme obligations. They are not actually in conflict, and this guide explains exactly why — plus what a policy that satisfies both looks like. For the wider compliance picture, see our complete PCI DSS compliance guide.

What does the NCSC actually say now?

The NCSC's position is blunt: regular password changing harms rather than improves security. The reasoning is behavioural rather than mathematical. People forced to change a password make the smallest change they can get away with, so the new password is predictably related to the old one. They reuse the result elsewhere, write it down, or forget it and generate a support call. And because stolen credentials are typically used within minutes, a 90-day cycle does nothing to stop an attacker who already has them. The one time you must change a password is when you know or suspect it has been compromised.

The NCSC is equally unenthusiastic about complexity rules — mandating symbols and mixed case simply produces predictable substitutions that attackers already model. In their place it recommends length over complexity, a deny list that blocks the most commonly used passwords, and password managers for secure storage. Its best-known public advice, three random words, exists because it produces a long password an ordinary person can actually remember.

This is not a fringe position. The government-backed Cyber Essentials scheme now writes it into its requirements, listing 'not enforcing regular password expiry' and 'not enforcing password complexity requirements' among the measures a certified organisation should adopt. Our comparison of Cyber Essentials and PCI DSS covers how the two schemes relate more broadly.

What does PCI DSS require?

Three rules matter most. Passwords used as an authentication factor need a minimum of twelve characters — or eight, if the system genuinely cannot support twelve. They must contain both numeric and alphabetic characters. And a new password cannot reuse any of the previous four.

It is worth pausing on the complexity point, because it is the single most repeated error in PCI advice online. PCI DSS does not require special characters, and it does not require upper and lower case. It requires numbers and letters. The standard mentions additional complexity only as something an organisation may choose to add. If a provider tells you the standard demands a symbol, they are quoting a myth rather than the document.

Separately, accounts must lock out after no more than ten invalid attempts, for a minimum of thirty minutes or until the user's identity is confirmed. That is stricter than the Cyber Essentials equivalent, so a business doing both should simply follow the PCI DSS figure. Idle sessions also have to require re-authentication after fifteen minutes — a small setting that catches out businesses with a shared back-office computer.

So what about the 90-day rule?

This is where the apparent conflict dissolves, and it is worth reading the requirement carefully rather than the summaries of it. The 90-day change requirement applies only where a password is the sole authentication factor — that is, in a single-factor implementation. The standard then offers an alternative even in that case: instead of rotating every 90 days, you may dynamically analyse the security posture of accounts and determine access in real time.

More decisively, the requirement's own applicability notes state that it does not apply to in-scope system components where multi-factor authentication is used. That single sentence is the reconciliation, and it comes from the standard itself rather than from anyone's interpretation. Turn on multi-factor authentication and the 90-day rule stops applying — which means you can follow the NCSC's advice and remain fully compliant.

There is a neat circularity here that works in your favour. PCI DSS v4.x already requires multi-factor authentication for all non-console access into the cardholder data environment, and for all remote access that could reach it. A business that has done what the standard already demands has, in the process, taken most of its accounts outside the scope of the rotation rule.

One correction while we are here, because it circulates widely: a targeted risk analysis does not let you extend the 90-day period. Risk-analysis-based timing applies to application and system account passwords under a different requirement entirely. For ordinary user accounts, the two defined options are 90 days or dynamic analysis — and multi-factor authentication removes the question.

What should a UK merchant's policy actually say?

• Multi-factor authentication on everything that offers it — email, payment portals, website and hosting admin, remote access, cloud services. This is required for card environments, and it is what disapplies the rotation rule.
• A minimum of twelve characters, with no maximum length. Twelve satisfies PCI DSS and the strongest Cyber Essentials option at once.
• Three random words, plus a digit. The three-words approach comfortably exceeds twelve characters, and adding a number satisfies the letters-and-numbers rule without resorting to symbol soup.
• A deny list blocking the most common passwords. The NCSC recommends it and PCI DSS names it as good practice.
• No routine expiry once multi-factor authentication is in place. Change on known or suspected compromise, not on a calendar.
• Lockout after no more than ten failed attempts, for at least thirty minutes.
• Individual named accounts, never shared logins — shared credentials destroy accountability and survive staff departures.
• Separate administrative accounts, used only for administration. Day-to-day email and browsing happen on a standard account.
• Change every default password before a device or service goes live, including on routers and card terminals.
• A password manager, and do not block pasting into login forms.

Not all multi-factor authentication is equal

Turning multi-factor authentication on is the highest-value security decision most small businesses will make. But the method matters, and the NCSC now ranks them explicitly. Strongest are FIDO2 credentials — passkeys and hardware security keys — because they will not authenticate to a lookalike domain at all, which defeats phishing at the root. Next come push-approval authenticator apps, which resist guessing and theft but remain vulnerable to prompt fatigue, where an attacker spams approval requests until somebody taps yes. Then app-based codes, which can be intercepted and relayed by a convincing fake login page in real time. Weakest are codes sent by text or email.

That ranking should inform your choices, not paralyse them. Cyber Essentials puts it well: text-message codes are not the most secure form of multi-factor authentication, but they offer a substantial advantage over having none at all, and any multi-factor authentication beats none. Use something better where you can — particularly on email and payment accounts — and do not let the search for the perfect option delay switching anything on.

There is a direct compliance reward for choosing well, too. PCI DSS v4.0.1 exempts accounts authenticated only with phishing-resistant factors from the requirement to apply multi-factor authentication for access into the card environment — the reasoning being that a passkey or hardware key already delivers what the requirement is trying to achieve. Choosing the strongest option can therefore simplify your assessment rather than complicate it.

Two further details on how the requirements interact. Multi-factor authentication can be enforced at the network level or at the individual system level, but you are not expected to do both — if it is required to reach the card environment's network, it need not be repeated at every system inside it. But the remote-access requirement and the card-environment requirement are genuinely separate: someone who connects remotely to your office network and then connects into the payment environment authenticates twice, and satisfying one does not excuse the other.

Does any of this really get enforced?

Yes, and increasingly on the data protection side rather than the card side. The Information Commissioner's Office fined a Merseyside law firm £60,000 in April 2025 after attackers brute-forced their way into an administrator account and stole more than 30 gigabytes of client data. The detail worth noting is that the firm did have multi-factor authentication — on its VPN. The account the attackers used had been excluded from it, because it was a service account belonging to a supplier, and nobody had risk-assessed it or noticed the four hundred failed login attempts against it. The firm then reported the breach 43 days after becoming aware, which the regulator treated as an aggravating factor. Larger cases that year followed the same shape: a forgotten account outside the protection everyone assumed was universal. Our guide to how PCI DSS, GDPR and Cyber Essentials fit together explains why a card breach is usually a data protection matter too.

The practical lesson is not the fine, it is the account. In every one of these cases the weak point was a legitimate account that nobody was using and nobody had protected. Reviewing who still has access — including leavers, contractors and your IT supplier's engineers — costs nothing. Our guide to remote access and card terminals covers the supplier side of that in detail.

Key takeaways

• The NCSC advises against forced password expiry and against mandated complexity; both are now written into Cyber Essentials as well.
• PCI DSS requires twelve characters with letters and numbers — it does not require special characters, whatever you may have been told.
• The 90-day rule applies only where a password is the only factor, and expressly does not apply where multi-factor authentication is in use.
• Turn on multi-factor authentication and you can follow current NCSC advice and remain fully PCI compliant — the two only appear to conflict.
• Prefer passkeys or hardware keys, then an authenticator app, then codes by text — but any multi-factor authentication beats none.

If you would rather have someone confirm your setup satisfies both sets of rules than work through the documents yourself, that is what we do. Fraud Defence First's fully managed PCI compliance service reviews how you authenticate, completes the right questionnaire with you and files it with your acquirer — a flat £100 + VAT a year.