Information Technology, Documents, & Records

Select a Policy to jump to: Data Risk Classification Guidelines E-mail as Official Communication for Students Identity Theft Prevention Program Password Policy Privacy Statement Related Party Disclosure Statement (Conflict of Interest Policy) Student Records Surveillance Camera Guidelines

Password Policy

Carleton College is committed to protecting the information that is gathered as part of the work of the College, including digital information. An important component of our approach is requiring a sufficiently strong password. 

Carleton has two password policies and a set of password strength requirements that apply to both policies. The use of a “passphrase” containing a set of words is recommended. The use of a password manager is also recommended. 

For Email Account holders: 

• Applies to faculty, staff, and students, and all users who have a Carleton email account
• Requires compliance with the password strength requirements (see below)
• Requires use of multi-factor authentication through the Duo application

For all other users: 

• Applies to users such as Alumni, emeritus or affiliates, who do not have a Carleton email account. These users log in to other (non-email) systems using their Carleton NetID.
• Requires compliance with the password strength requirements (see below)
• Users must have a non-Carleton email address on record 

Password strength requirements: 

• Passwords must contain at least 15 characters (and is encouraged to be longer)
• Passwords cannot contain easily-guessable words 
• Passwords cannot contain easily-guessed personal or Carleton information
• Passwords cannot be available on lists of previously compromised passwords
• Passwords do not require special characters
• Passwords do not expire, but are checked against known password lists to ensure that they continue to offer good protection 

This policy is managed by Information Technology Services (ITS). Changes are approved by the Technology Planning & Priorities Committee (TP&PC).

Last Revised: March 14, 2024

For: Faculty, Staff, Students

Maintained by: Information Technology Services

List all Policies & Guidelines for Information Technology, Documents, & Records