Templates / Attestation Flow

Password and authentication policy template

For all staff with company accounts. It requires a unique passphrase per account stored in the password manager, MFA wherever offered, never sharing codes even with IT, and password changes on suspected compromise rather than a fixed schedule.

• App: Attestation Flow for Confluence
• Category: Security
• Edition: Picking the pack works in every edition; the paid settings and the starter text need a paid licence
• Re-acknowledge: every 365 days

Note shown to readers:

By acknowledging, you confirm you will follow the password and multi-factor authentication rules.

Template. This template is a starting point, not legal advice. Adapt it to your organisation, your contracts and the law that applies to you, and have it reviewed by a qualified professional before you rely on it.

Rules

• Use a unique password or passphrase for every account, at least [length] characters.
• Store passwords in [password manager]; never in documents, chat or notes.
• Turn on multi-factor authentication wherever it is offered, and always for email, cloud services and admin accounts.
• Never share a password or an MFA code with anyone, including IT.
• Change a password immediately if you think it has been exposed, and report it.

Why no forced rotation

In line with current NIST guidance, passwords are changed when there is a reason (suspected compromise), not on a fixed schedule.

Help

Locked out or suspicious prompt? Contact [IT contact].

Includes 2 quiz questions; the answers are not published here. They are shown only in the app's requirement editor, to the person setting up the requirement, who can change them before saving.

1. Which is the best practice?
   • Reuse one strong password everywhere
   • A unique passphrase per account, stored in the company password manager
   • Write passwords on a sticky note
2. Someone from "IT" calls and asks for your MFA code. What do you do?
   • Give it to them
   • Refuse and report the call to [security contact]

Edit a Confluence page, insert the Attestation Flow macro, open the requirement editor and pick the pack under Start from a policy pack. It fills the note and the due date; with a paid licence it also fills the re-acknowledgement window, the minimum reading time and the quiz, and can add the starter text to the page. Required readers are never preset: you choose them.

• Attestation Flow for Confluence documentation
• Confluence policy templates: all 16 templates