8.3.6Strong authentication for users and administrators is established and managed

Defined Approach Requirements:

If passwords/passphrases are used as authentication factors to meet Requirement 8.3.1, they meet the following minimum level of complexity:

- A minimum length of 12 characters (or IF the system does not support 12 characters, a minimum length of eight characters).

- Contain both numeric and alphabetic characters.

Defined Approach Testing Procedures:

8.3.6 Examine system configuration settings to verify that user password/passphrase complexity parameters are set in accordance with all elements specified in this requirement.