Passwords must meet minimum complexity and length requirements.

Common, breached, or reused credentials should be avoided.

Password updates may be required after suspicious events.

Use a password manager and unique credentials for each service.

Never share passwords or enter them on untrusted devices.

Enable additional verification controls where available.