8.3.6 If passwords/passphrases are used as authentication factors to meet Requirement 8.3.1, they meet the following minimum level of complexity: • A minimum length of 12 characters (or IF the system does not support 12
If passwords/passphrases are used as authentication factors to meet Requirement 8.3.1, they meet the following minimum level of complexity: • A minimum length of 12 characters (or IF the system does not support 12.
5
artefacts
2
held by a system
2
at each review
moderate
to go live
Identity provider / directory
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- System configuration settings showing minimum length of 12 characters, or eight where the system cannot support 12 · Identity provider / directory
- System configuration showing both numeric and alphabetic characters are required · Identity provider / directory
periodic reviewEvidence produced at each review
- Evidence the parameters are enforced on every system where passwords are used as the authentication factor · Identity provider / directory
- Test evidence that a non-conforming password is rejected · Identity provider / directory
governing documentDocuments that govern the control
- Documentation of any system limited to eight characters and the reason it cannot support 12 · Policy repository / GRC workspace
First move
Start with the 2 of 5 artefacts that already live in a system (Identity provider / directory); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Complexity enforced at the directory while applications with local password stores accept weaker values
- The eight character allowance applied by default rather than only where the system genuinely cannot support 12
- Existing passwords never brought up to the standard because the policy applies only at next change
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet8.3.5 If passwords/passphrases are used as authentication factors to meet Requirement 8.3.1, they are set and reset for each user as follows: • Set to a unique value for first-time use and upon reset. • · 8.3.7 Password history