For customers not using SSO, does the system have password complexity or length limitations and/or restrictions?

For users who are not on Single Sign-On (SSO), the concern here is whether your system enforces any password complexity or length rules.

Password complexity refers to requirements like including uppercase letters, lowercase letters, numbers, and special characters. Password length refers to the minimum and maximum number of characters allowed.

The guidance specifically asks about limitations or restrictions that might prevent users from creating strong passwords. For example, if your system has a maximum password length of 16 characters or doesn't support certain special characters, that would be considered a limitation.

This question is being asked in a security assessment because password strength is a critical security control. Systems that artificially limit password complexity or length (like not allowing special characters or having short maximum lengths) can prevent users from creating sufficiently strong passwords, making accounts more vulnerable to brute force or dictionary attacks.

To best answer this question:

1. Be specific about any password limitations your system has
2. Explain your minimum requirements (which are good) but focus on any maximum limits (which are potential security concerns)
3. Mention any character restrictions
4. If you have no limitations that would prevent strong passwords, explain your approach

Note that the guidance specifically asks you to answer 'yes' if your solution has internal limits - this means they're looking for potential security weaknesses in how your system handles passwords.