Best password policies: Strong, managed, and kept secure.
Strong
- long(12 or more characters)
- full character set required(upper, lower, number, symbol)
- no complete words
- no personal information if based on a word
managed
- kept in a secure location in case a lookup is needed
- changed regularly
- not the same as the previous pass
- kept hashed in a database behind a completely random password(of insane strength) or on a non networked database that requires physical secure access
secure
- recovery happens in person or thorough secure channels
- passwords are reviewed before changing(either automatic or on a schedule)
- no user knows another users password(if it's discovered they do and don't have a good reason for it, force a password change)
- option for 2 factor authentication to make it more secure
these tips are the best for password security and often get used on an enterprise level.
About 2 factor and some problems with it:
Of course that option for 2 factor authentication often gets tossed around as a "Why not just use 2 factor authentication then". Well there's actually a reason for this: you probably should for accounts that deal with sensitive data. Oh wait yeah there's also some pitfalls:
For everyone else this adds a physical layer of authentication that costs money, time, and setup as well as running or hiring a service to generate, and keep the authentication in sync. With networked and off site locations possible, this can run into some problems if not handled correctly, and over time always needs upkeep. Worse yet loss of keygen is a common problem, so backups are needed on site to be handed out, and if on a business trip 2 factor leads to a huge problem if lost. Then there's training them in how to use it, and forcing them to still have secure passwords. This takes a long time to get running(depending on the size of the company, this could actually lead to an entire IT overhaul), and requires training and staff dedicated to just maintaining it.
TL,DR:
Implement secure passwords, and talk to the company about password policy and maintenance. Then offer the option of 2 factor(and force it in some places if needed). These best practices are enough to keep many companies safe. However never forget that passwords are only 1 part of cyber security.