diff --git a/policies/password-policy.md b/policies/password-policy.md
index 46da16b..cc754e7 100644
--- a/policies/password-policy.md
+++ b/policies/password-policy.md
@@ -19,3 +19,8 @@ Personal vaults must not store Nexus credentials.
 
 Non-compliance results in account lockout after 5 failed attempts.
 Locked accounts require IT helpdesk intervention.
+
+## Hardware tokens
+
+For production system access, hardware security keys (YubiKey 5) are preferred over TOTP.
+Contact IT to request a YubiKey. Replacement: maximum once per 2 years.