Passwords are generally considered fundamentally broken, so that any password policy is an attempt to shore things up at best. Having said that, a 'best practice' password policy will typically include at least the following requirements, in addition to minimum password length:
A maximum age for the password, so that the same password is not used indefinitely
A password history, to stop users changing back to one of N previously used passwords (and thus effectively not changing it at all).
Some policies will also have a minimum age, to stop people changing their password N times (and thus effectively bypassing the password history mechanism, and not changing it at all).
(Notice the last two of these controls are to stop users attempting to get round the first! This is yet another clue that passwords are pretty broken)
Typically these will include requirements for 'special' characters, or use of several character classes, with the goal being to increase the effective number of bits in the password and increase the amount of time it takes to brute force a password.
It is also useful to have a policy that disallows not just dictionary words (such as password), but dictionary derived words (e.g. password123, drowssap321 etc). The goal here is to prevent dictionary attacks which can speed up automated password cracking.
Beyond this it is possible to debate all sorts of other requirements and exact values for the various parameters (must users change passwords every 90 days or 30 days or every 5 minutes? etc), as well as the amount of entropy you gain/lose by complexity requirements - but where these things matter greatly then passwords are almost certainly not a good enough control in the first place.