The password policy

Aligned with NIST 800-63b: complexity requirements dropped, minimum length raised to 15 characters, and every new password checked against lists of trivial and breach-exposed (“burnt”) passwords. Non-compliant passwords across every account type — primary, secondary, service, database, guest — must rotate during 2026.

---

Topology

• Part of: security-governance
• Cites: password-policy-nist — the policy change.