You need to design your company's password policy to adhere to the National Institute of Standards and Technology (NIST) guidelines for user password security.
What is the minimum password length that you should require to be consistent with the NIST guidelines?
According to the CCST Cybersecurity course, NIST guidelines (SP 800-63B) recommend a minimum password length of 8 characters for user-generated passwords, without requiring overly complex composition rules, but encouraging longer passphrases for increased security.
'NIST guidelines specify that user-generated passwords must be at least 8 characters in length, and systems should allow passwords up to at least 64 characters.'
(CCST Cybersecurity, Essential Security Principles, Authentication Best Practices section, Cisco Networking Academy)