What is Humareso's Password Policy

At Humareso, we treat the data of every client as if it were our own.

By following this password policy, Humareso can ensure the confidentiality, integrity, and availability of its clients' data and minimize the risk of unauthorized access or data breaches. The use of Keeper ensures that passwords are securely stored and generated according to the password creation and complexity requirements. The prohibition on storing passwords in files or on paper prevents unauthorized access to passwords, while the prohibition on using personal password storage services ensures that the passwords are stored in a secure manner and remain company property. The use of multi-factor authentication on third-party systems provides an additional layer of security, while password monitoring and alerting ensure that any breaches or warnings are addressed promptly.

Password Policy for Humareso:

1. Password Creation and Complexity Requirements:
   1. All passwords must be at least 12 characters long.
   2. Passwords must include a combination of
      1. upper and lower-case letters,
      2. numbers, and
      3. special characters.
   3. Passwords should be generated by Keeper whenever possible.
   4. Passwords should never contain references or initials of the client, project, year, or Humareso.
   5. Passwords should never be used more than once.
2. Password Storage and Sharing:
   1. All company passwords must be stored securely in Keeper.
   2. Employees cannot store passwords in files, including Word Docs, digital Sticky notes, or other text-based documents on an Employee device.
   3. Employees cannot store passwords on external websites, including project management systems such as Asana or Atlassian or CRM systems such as HubpSot.
   4. Passwords should never be printed or written.
   5. Employees cannot share passwords externally.
   6. Employees cannot store passwords using other personal password storage services such as iCloud Keychain or LastPass unless prior approval is given, such as if a client shares their passwords with us.
3. Multi-Factor Authentication:
   1. Multi-factor authentication must be enabled on any third-party system that supports it as a feature.
   2. Multi-factor authentication is mandatory if the system includes client confidential information.
   3. Authentication for MFA should be stored in Keeper where available through a Timed One Time Password (TOTP)
      1. Should TOTP not be available, Employee is to use either email-based authentications OR phone-based SMS with their Teams phone number.
      2. Exceptions can be made to use personal SMS authentication ONLY IF no other methods are available.
4. Password Monitoring and Alerting:
   1. Users must monitor Keeper for breach alerts and warnings.
   2. Users must remediate any breach alerts and warnings within 5 business days.