IA.L2-3.5.7
Password Complexity
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee IA.L2-3.5.7 in the reference catalog with its NIST cross-references
Official requirement
Enforce a minimum password complexity and change of characters when new passwords are created.
Assessment objectives
a. password complexity requirements are defined;
b. password change of character requirements are defined;
c. minimum password complexity requirements as defined are enforced when new passwords are created; and
d. minimum password change of character requirements as defined are enforced when new passwords are created.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Enforce the defined password complexity and character-change requirements.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You work with management to define password complexity rules and ensure they are listed in the company’s security policy. You define and enforce a minimum number of characters for each password and ensure that a certain number of characters must be changed when updating passwords [a,b]. Characters include numbers, lowercase and uppercase letters, and symbols [a]. These rules help create hard -to-guess passwords, which help to secure your network.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Identification and authentication policy; password policy; procedures addressing authenticator management; system security plan; system configuration settings and associated documentation; system design documentation; password configurations and associated documentation; other relevant documents or records
Common mistakes
Writing password rules without verifying that every relevant system enforces them.