Password

Applies to. 8.3.1 places a password or passphrase in the 'something you know' factor type, and the password rules apply wherever that factor is used to meet 8.3.1. For user accounts they are: at least 12 characters, or eight where the system cannot support 12, with both alphabetic and numeric characters (8.3.6); a unique value on first issue and on reset, changed at first use (8.3.5); no reuse of any of the last four (8.3.7); and, where the password is the only factor, a change at least every 90 days or dynamic analysis of the account's security posture instead (8.3.9). Service providers apply that same 90-day or dynamic-analysis choice to their customers' user passwords under 8.3.10.1, and 8.3.8 requires all users to be told how to choose and protect their passwords and to change them on any suspicion of compromise.

Example. A store manager's back-office password is reset by the help desk after she forgets it. The temporary value is unique to her and must be changed at first login (8.3.5); her first choice is rejected at nine characters because the system supports twelve (8.3.6), and her second because it matches one of her previous four (8.3.7). As the system uses no second factor, she will be prompted to change it again within 90 days (8.3.9).

Limits. A password is one authentication factor, not authentication itself: 8.3.1 accepts a token device, smart card or biometric in its place, and where MFA is required a password alone never satisfies it. The user-password rules stop at user accounts: application and system accounts follow 8.6.2, which forbids hard-coding their passwords in scripts, configuration or property files, or bespoke and custom source code, and 8.6.3, which sets their change frequency and complexity through the entity's targeted risk analysis rather than a fixed 90 days. Vendor default passwords are a separate problem that 2.2.2 handles: if the default account is kept its password is changed to meet 8.3.6, and if not, the account is removed or disabled. A PIN is a different Council term even though it is also something the user knows.