Password Complexity
What is Password Complexity?
Requirements for password composition including minimum length, character variety, and prohibition of common or previously used passwords.
Terms that appear alongside password complexity
Each of these is named in at least one of the same controls as password complexity. The number is how many controls name both.
- authentication 6 shared controls
- access control 4 shared controls
- nist 4 shared controls
- saml 3 shared controls
- audit 3 shared controls
- policy 3 shared controls
- role based access control 2 shared controls
- oauth 2 shared controls
Frameworks that govern password complexity
What the standards actually require on password complexity
Requirements naming password complexity across 6 standards, quoted from the control text.
Set a minimum complexity for passwords, and require that a newly created password differ in its characters from the one it replaces.
IA.L2-3.5.7 · Password Complexity →Access controls enforce password complexity and limit password attempts and reuse.
ffiec-cybersecurity-assessment-tool-cat::D3.PC.Am.B.7 · D3.PC.Am.B.7 Access and Data Management (Baseline 7) →Where a mainframe is used, management implements role-based access control, segregation of duties and multifactor authentication, password complexity, inactivity timeouts and login restrictions, encryption of sensitive information, activity logging of user acc...
ffiec-it-examination-handbook::AIO-V.C.2(b) · V.C.2(b) Mainframe Security Software (Architecture, Infrastructure, and Operations) →Enforce password complexity per NIST SP 800-63B; minimum 12 characters (FedRAMP); compare against breach lists.
IA-5(1) · Password-Based Authentication →Enforce password complexity per NIST SP 800-63B; minimum 12 characters (FedRAMP); compare against breach lists.
IA-5(1) · Password-Based Authentication →Critical thinking optimizes quality and compliance of computerized systems within the business processes they support, and it has to be allowed by the QMS and the validation policy, with templates used as prompts and essential elements defined rather than fixe...
gamp-5-good-automated-manufacturing-practice::M12 · Appendix M12 Critical Thinking →Questions people ask about password complexity
What is Password Complexity?
Why is Password Complexity important for compliance?
Which compliance frameworks address Password Complexity?
Where can I learn more about Password Complexity?
See how Password Complexity applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.