Washington County IT committee to require 16-character passwords and pursue password-manager rollout

The Washington County Information Technology Committee heard a cybersecurity briefing on June 23, 2026, during which IT Chief Information Officer Teri McNall said the county will change its password policy to require sixteen-character passwords and will limit forced password changes to once a year.

McNall told the committee the change is intended to reduce credential-reuse risks and that the county plans to deploy password managers: "Password managers are very critical and something they will be looking to roll out to the county soon and hoping to get grant funding to at least help with the rollout and implementation," she said. The cybersecurity materials attached to the report warned that weak passwords and reuse — especially when employees use small variations of the same password — create a major security risk because attackers can reuse exposed credentials across services.

The committee reviewed supporting metrics and policy work. A separate project entry in the packet lists a countywide cyber policy revamp at 95% completion and under internal review. The materials also included phishing and inbound email statistics for March–May and flagged areas for further protection investments.

The cybersecurity measures are framed as operational changes rather than one-time capital purchases; McNall’s update noted the county is evaluating grant support to fund password-manager rollout and implementation. The committee did not take a formal vote on new policy language at the session; the packet lists the policy revamp as in internal review and ongoing.