Skip to main content

Pro audit program · v1.0

Password Policy Quick Audit

Check your password rules against modern NIST guidance — length, rotation, complexity, password manager use.

  • General target area
  • NIST 800-63 framework
  • 6 controls in this program
  • Cyentrix Cyentrix Trusted Author
Sign in to run → Back to library

About this program

Check your password rules against modern NIST guidance — length, rotation, complexity, password manager use.

Risks addressed

  • High Users pick weak or reused passwords that appear in breach corpora
  • Medium Forced rotation drives users to predictable variants
  • High Brute-force attacks succeed without lockout / throttling

Controls (6)

  1. Minimum length 12+ characters

    High

    Minimum length 12+ characters

    How to test + evidence

    Testing procedure: Review password policy in IdP. Expect length at least 12.

    Evidence to collect: IdP password policy export.

  2. No mandatory rotation without compromise

    Medium

    No mandatory rotation without compromise

    How to test + evidence

    Testing procedure: Confirm passwords are not forced to rotate on a schedule unless breach is suspected.

    Evidence to collect: Policy document or IdP setting.

  3. Breached-password screening enabled

    High

    Breached-password screening enabled

    How to test + evidence

    Testing procedure: Verify the IdP checks new passwords against breach corpora (Pwned Passwords / HIBP).

    Evidence to collect: IdP setting screenshot.

  4. Password manager provided to all staff

    Medium

    Password manager provided to all staff

    How to test + evidence

    Testing procedure: Confirm an approved password manager is provisioned and used by all staff.

    Evidence to collect: Licence count vs headcount.

  5. Account lockout / throttling configured

    Medium

    Account lockout / throttling configured

    How to test + evidence

    Testing procedure: Test the lockout threshold; confirm progressive throttling rather than permanent lockout.

    Evidence to collect: Auth-failure policy export.

  6. No password reuse across services for admins

    High

    No password reuse across services for admins

    How to test + evidence

    Testing procedure: Interview + spot-check; verify admins use unique credentials per system.

    Evidence to collect: Admin attestation + vault entries.