Skip to main content

Pro audit program · v1.0

Password Policy Quick Audit

Check your password rules against modern NIST guidance — length, rotation, complexity, password manager use.

  • General target area
  • NIST 800-63 framework
  • 6 controls in this program
  • Cyentrix Cyentrix Trusted Author
Sign in to run → Back to library

About this program

Check your password rules against modern NIST guidance — length, rotation, complexity, password manager use.

Risks addressed

  • High Users pick weak or reused passwords that appear in breach corpora
  • Medium Forced rotation drives users to predictable variants
  • High Brute-force attacks succeed without lockout / throttling

Controls (6)

  1. Minimum length 12+ characters

    High

    This control enforces a minimum password length of 12 or more characters for all user accounts across systems and applications. Longer passwords exponentially increase the computational effort required for brute-force and dictionary attacks, making credential compromise significantly more difficult. The…

    How to test + evidence

    Testing procedure: Review password policy in IdP. Expect length at least 12.

    Evidence to collect: IdP password policy export.

  2. No mandatory rotation without compromise

    Medium

    This control prohibits the mandatory, time-based rotation of cryptographic credentials (passwords, API keys, certificates, secrets) unless evidence of compromise exists. Forced periodic rotation without cause increases operational risk by encouraging weaker credential selection, insecure storage practices, and reduced change control…

    How to test + evidence

    Testing procedure: Confirm passwords are not forced to rotate on a schedule unless breach is suspected.

    Evidence to collect: Policy document or IdP setting.

  3. Breached-password screening enabled

    High

    Breached-password screening prevents users from selecting or retaining passwords that have been exposed in public data breaches by comparing credential hashes or values against known-compromised password databases (e.g., Have I Been Pwned, vendor threat intelligence feeds). This control is typically…

    How to test + evidence

    Testing procedure: Verify the IdP checks new passwords against breach corpora (Pwned Passwords / HIBP).

    Evidence to collect: IdP setting screenshot.

  4. Password manager provided to all staff

    Medium

    This control requires the organization to procure, deploy, and maintain a password manager solution for all staff members to securely generate, store, and retrieve credentials. The password manager should enforce strong, unique passwords for each service or application, eliminating the…

    How to test + evidence

    Testing procedure: Confirm an approved password manager is provisioned and used by all staff.

    Evidence to collect: Licence count vs headcount.

  5. Account lockout / throttling configured

    Medium

    Account lockout and throttling controls prevent unauthorized access by automatically disabling or delaying authentication attempts after a defined number of consecutive failed login attempts. This control typically enforces a lockout threshold (e.g., 5-10 failed attempts), a lockout duration (e.g., 15-30…

    How to test + evidence

    Testing procedure: Test the lockout threshold; confirm progressive throttling rather than permanent lockout.

    Evidence to collect: Auth-failure policy export.

  6. No password reuse across services for admins

    High

    This control requires that administrative accounts use unique passwords that are not reused across multiple systems, applications, or services within the organization's IT environment. Password uniqueness is enforced through technical controls such as password history checks, identity governance platforms that…

    How to test + evidence

    Testing procedure: Interview + spot-check; verify admins use unique credentials per system.

    Evidence to collect: Admin attestation + vault entries.