From 6c35b9ece311a95bc700a77ae5208b9a8d175e25 Mon Sep 17 00:00:00 2001
From: Katrin Hoffmann <k.hoffmann@nexus.local>
Date: Tue, 14 Apr 2026 09:30:00 +0000
Subject: [PATCH] Password policy: add YubiKey guidance for prod access

---
 policies/password-policy.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/policies/password-policy.md b/policies/password-policy.md
index 46da16b..cc754e7 100644
--- a/policies/password-policy.md
+++ b/policies/password-policy.md
@@ -19,3 +19,8 @@ Personal vaults must not store Nexus credentials.
 
 Non-compliance results in account lockout after 5 failed attempts.
 Locked accounts require IT helpdesk intervention.
+
+## Hardware tokens
+
+For production system access, hardware security keys (YubiKey 5) are preferred over TOTP.
+Contact IT to request a YubiKey. Replacement: maximum once per 2 years.