PR.AA-03.201
Does your organization enforce minimum strength requirements for passwords, PINs, and other authenticators?
Explanation
Password strength policies are essential for preventing unauthorized access through brute force or dictionary attacks. Strong policies typically include requirements for minimum length, complexity (uppercase, lowercase, numbers, special characters), and restrictions on common or previously breached passwords. As evidence, you could provide a screenshot of your password policy configuration from your identity management system, directory service (like Active Directory), or a written policy document that clearly outlines the minimum requirements enforced across your systems.
Implementation Example
Enforce policies for the minimum strength of passwords, PINs, and similar authenticators
ID: PR.AA-03.201
Context
- Function
- PR: PROTECT
- Category
- PR.AA: Identity Management, Authentication, and Access Control
- Sub-Category
- Users, services, and hardware are authenticated

