Where you require the use of passwords, they should be easy to remember, but hard for somebody else to guess. An example strategy to use is three random words (for example, dogbluetree). You should not enforce unnecessarily complex rules on staff, as it increases the burden on them and rarely increases security. For example many users simply swap an I for a 1 or ! symbol, and hackers know this.