At least 12 characters, with an uppercase letter, a lowercase letter, a number and a special character (! @ # $ % - _ .). Avoid common passwords, simple sequences (1234, abcd) and your own or your organisation's name.
Your organisation starts in monitor mode with the default policy. Drift only blocks after you calibrate it on your own traffic.