SFS 3 / SF 6

Back to SFS 3

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Are password policies enforced to require complexity, minimum length, and regular rotation for all user accounts throughout the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Documented password policy with specified complexity requirements, minimum length, and rotation intervals; audit evidence confirming consistent enforcement

Assessment criterion and evidence

Actor: Organization identity management administrators. Scope: All user accounts within organizational directory services and authentication systems. Evidence period: During the review period. Required evidence: Current organizational password policy document; System audit logs demonstrating policy application. Negative criterion: Absence of required password policy or observed deviations from policy specifications in configured systems. Missing evidence: Assessment pending due to incomplete policy documentation or unavailable enforcement verification records

View the JSON record (opens in a new tab).

Assessment result: unset.