State of Indiana Password Policy

Strong passwords help protect your account and the State of Indiana’s systems from unauthorized access. These rules explain what you need to do when creating or updating your password, depending on the type of account you use.

Standard User Accounts

These are the everyday accounts most employees use. 

Password Requirements

• Must be at least 16 characters long.
• Must include a mix of uppercase letters, lowercase letters, numbers, and special
  characters.
• Cannot include your first name, last name, or username.
• Cannot be a common or easily guessed password. A list is held by Okta for password reference. This is not publicly available.
• Pass phrases are suggested.

Password Changes

• You must wait 1 day before changing your password again.
• Your password will expire every 365 days.
• You cannot reuse any of your last 24 passwords.

Account Lockouts

• Your account will lock after 5 failed login attempts.
• It will automatically unlock after 15 minutes.
• The failed-attempt counter resets after 15 minutes.

Multi-Factor Authentication (MFA)

• MFA is always required.
• MS and voice call MFA methods may not be available in some cases. Voice MFA will be retired at the end of 2026.

Elevated Accounts

These accounts have administrative or privileged access.

Elevated Account Password Requirements

• Must be at least 16 characters long.
• Must include strong combinations of letters, numbers, and special characters.

Elevated Account Password Changes

• You must wait 1 day before changing your password again.
• Password expires every 90 days.
• You cannot reuse any of your last 24 passwords.

Elevated Account Lockouts

• Lockout after 3 failed attempts.
• Automatic unlock is disabled — you must use the self-service unlock process.

Elevated Account Multi-Factor Authentication (MFA)

• MFA is always required.
• SMS and voice options are not permitted.