IT Password
IT Password Policy
Purpose
This policy sets out the standards for password creation, management, and security at The Independent Grammar School: Durham (IGS: Durham). It ensures that all users protect school systems, data, and examination materials in line with UK GDPR, the Data Protection Act 2018, the school’s Cyber Security Policy, and the Joint Council for Qualifications (JCQ) regulations for the secure management of examination materials.
Scope
This policy applies to:
- All staff (teaching, support, temporary, supply and peripatetic)
- All students
- Directors and volunteers with system access
- Any third party granted access to school systems
- All devices used to access school systems (school-owned or personal)
Principles
- Passwords are a critical security control and must be kept confidential.
- Users are responsible for safeguarding their own credentials.
- Passwords must never be shared or stored insecurely. School-approved secure password managers may be used for ordinary accounts, subject to the stricter examination requirements below.
- Additional controls apply to staff involved in the management of examinations, in line with JCQ requirements.
Staff Password Requirements
All staff passwords must meet the following minimum standards:
- Minimum length: 12 characters.
- Must be strong and unpredictable, using three random words or a school-approved password generator. Combinations of uppercase, lowercase, numbers and symbols are required only where the particular system requires them.
- Must not contain personal information (names, birthdays, pets, etc.).
- Must not reuse passwords from other systems.
- Must be changed immediately if compromised or suspected compromised.
- Routine password changes are not required unless a particular system or awarding body requires them. Compromised passwords must not be reused.
Staff must report suspected password or account compromise immediately to IT Support and the Principal, following the school’s Cyber Security Policy.
Multi-Factor Authentication (MFA)
- MFA is mandatory for all staff accounts accessing school systems, cloud services, or examination-related platforms.
Student Password Requirements
Students must use passwords that meet the following standards:
- Minimum length: 8 characters.
- Must be strong and unpredictable, using three random words or a school-approved password generator, with age-appropriate support. Character combinations are required only where the particular system requires them.
- Must not share passwords with peers.
- Must report suspected compromise immediately to their teacher, form tutor or IT Support.
Job-Specific Requirements
JCQ regulations require strict control of access to examination materials, systems, and communications. To comply:
Access to Examination Systems
- Only staff authorised by the Head of Centre may access systems containing confidential examination materials. Being an invigilator does not automatically confer this authorisation.
Accounts used for JCQ-related systems must have:
- Unique credentials (no shared login credentials).
- Strong passwords meeting staff requirements.
- Mandatory MFA meeting the awarding body’s requirements. Devices used for MFA must not be shared between staff.
- Restricted permissions based on role.
- Regular review, including by the Head of Centre before each examination series, with unused or unneeded accounts closed promptly.
Secure Storage of Digital Examination Materials
- Passwords for systems storing or transferring examination materials must never be shared verbally, written down, or stored in email. Password management must comply with current JCQ and awarding body instructions.
- Access logs must be monitored for unusual activity.
- Passwords must be changed immediately after any suspected breach.
Handling of Electronic Question Papers (EQPs)
Where applicable:
- EQPs must be downloaded only by authorised staff using secure, password-protected systems and in accordance with current JCQ and awarding body instructions.
- Devices used must be encrypted and password-protected.
- Passwords for EQP access must not be disclosed to anyone other than the authorised user.
- Secure files must be accessed only by the named individual(s) to whom they are sent. Emails or links to secure examination materials must never be forwarded or shared.
Password Management and Storage
Prohibited Practices
Users must not:
- Write passwords on paper or store them in unsecured notes. School-approved secure password managers may be used for ordinary accounts; examination accounts remain subject to the stricter requirements above.
- Save passwords in browsers without encryption or outside school-approved arrangements.
- Share passwords with colleagues, students, or IT staff.
- Use the same password for school and personal accounts.
- Use simple or guessable passwords (e.g., “Password123”).
Password Reset Procedures
Staff
- Staff must contact IT Support for identity-verified resets.
- IT Support must confirm identity using at least two appropriate verification methods, such as in-person confirmation and contact through established school records. Contact details supplied solely in the reset request must not be relied upon.
- Temporary passwords must be unique, time-limited, supplied securely, and require immediate creation of a new password at first login.
Students
- Students may request resets via their form tutor or admin support.
- Identity must be checked before a reset. Temporary passwords must be unique, time-limited and supplied securely, and must be changed immediately upon first login, with age-appropriate support.
Monitoring and Compliance
- The IT Manager will conduct periodic audits of password controls, MFA compliance, and access logs. Users must not disclose their passwords for an audit.
- Non-compliance may result in disciplinary action.
- JCQ compliance checks will be carried out before each examination series.
Review
This policy will be reviewed annually or sooner if:
- JCQ regulations change.
- Cyber security guidance changes.
- A security incident requires policy revision.
The Independent Grammar School: Durham
Reviewed: October 2026. Next Review: October 2027
IT Password Policy
Purpose
This policy sets out the standards for password creation, management, and security at The Independent Grammar School: Durham (IGS: Durham). It ensures that all users protect school systems, data, and examination materials in line with UK GDPR, the Data Protection Act 2018, the school’s Cyber Security Policy, and the Joint Council for Qualifications (JCQ) regulations for the secure management of examination materials.
Scope
This policy applies to:
- All staff (teaching, support, temporary, supply and peripatetic)
- All students
- Directors and volunteers with system access
- Any third party granted access to school systems
- All devices used to access school systems (school-owned or personal)
Principles
- Passwords are a critical security control and must be kept confidential.
- Users are responsible for safeguarding their own credentials.
- Passwords must never be shared or stored insecurely. School-approved secure password managers may be used for ordinary accounts, subject to the stricter examination requirements below.
- Additional controls apply to staff involved in the management of examinations, in line with JCQ requirements.
Staff Password Requirements
All staff passwords must meet the following minimum standards:
- Minimum length: 12 characters.
- Must be strong and unpredictable, using three random words or a school-approved password generator. Combinations of uppercase, lowercase, numbers and symbols are required only where the particular system requires them.
- Must not contain personal information (names, birthdays, pets, etc.).
- Must not reuse passwords from other systems.
- Must be changed immediately if compromised or suspected compromised.
- Routine password changes are not required unless a particular system or awarding body requires them. Compromised passwords must not be reused.
Staff must report suspected password or account compromise immediately to IT Support and the Principal, following the school’s Cyber Security Policy.
Multi-Factor Authentication (MFA)
- MFA is mandatory for all staff accounts accessing school systems, cloud services, or examination-related platforms.
Student Password Requirements
Students must use passwords that meet the following standards:
- Minimum length: 8 characters.
- Must be strong and unpredictable, using three random words or a school-approved password generator, with age-appropriate support. Character combinations are required only where the particular system requires them.
- Must not share passwords with peers.
- Must report suspected compromise immediately to their teacher, form tutor or IT Support.
Job-Specific Requirements
JCQ regulations require strict control of access to examination materials, systems, and communications. To comply:
Access to Examination Systems
- Only staff authorised by the Head of Centre may access systems containing confidential examination materials. Being an invigilator does not automatically confer this authorisation.
Accounts used for JCQ-related systems must have:
- Unique credentials (no shared login credentials).
- Strong passwords meeting staff requirements.
- Mandatory MFA meeting the awarding body’s requirements. Devices used for MFA must not be shared between staff.
- Restricted permissions based on role.
- Regular review, including by the Head of Centre before each examination series, with unused or unneeded accounts closed promptly.
Secure Storage of Digital Examination Materials
- Passwords for systems storing or transferring examination materials must never be shared verbally, written down, or stored in email. Password management must comply with current JCQ and awarding body instructions.
- Access logs must be monitored for unusual activity.
- Passwords must be changed immediately after any suspected breach.
Handling of Electronic Question Papers (EQPs)
Where applicable:
- EQPs must be downloaded only by authorised staff using secure, password-protected systems and in accordance with current JCQ and awarding body instructions.
- Devices used must be encrypted and password-protected.
- Passwords for EQP access must not be disclosed to anyone other than the authorised user.
- Secure files must be accessed only by the named individual(s) to whom they are sent. Emails or links to secure examination materials must never be forwarded or shared.
Password Management and Storage
Prohibited Practices
Users must not:
- Write passwords on paper or store them in unsecured notes. School-approved secure password managers may be used for ordinary accounts; examination accounts remain subject to the stricter requirements above.
- Save passwords in browsers without encryption or outside school-approved arrangements.
- Share passwords with colleagues, students, or IT staff.
- Use the same password for school and personal accounts.
- Use simple or guessable passwords (e.g., “Password123”).
Password Reset Procedures
Staff
- Staff must contact IT Support for identity-verified resets.
- IT Support must confirm identity using at least two appropriate verification methods, such as in-person confirmation and contact through established school records. Contact details supplied solely in the reset request must not be relied upon.
- Temporary passwords must be unique, time-limited, supplied securely, and require immediate creation of a new password at first login.
Students
- Students may request resets via their form tutor or admin support.
- Identity must be checked before a reset. Temporary passwords must be unique, time-limited and supplied securely, and must be changed immediately upon first login, with age-appropriate support.
Monitoring and Compliance
- The IT Manager will conduct periodic audits of password controls, MFA compliance, and access logs. Users must not disclose their passwords for an audit.
- Non-compliance may result in disciplinary action.
- JCQ compliance checks will be carried out before each examination series.
Review
This policy will be reviewed annually or sooner if:
- JCQ regulations change.
- Cyber security guidance changes.
- A security incident requires policy revision.
The Independent Grammar School: Durham
Reviewed: October 2026. Next Review: October 2027
Discover more
If you would like to know more about life at IGS, or to book an in-person visit, contact us now.
Discover more
If you would like to know more about life at IGS, or to book an in-person visit, contact us now.