thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Fundamentals & Crypto · Foundational

Password Policy

Rules governing password creation, storage, and use, now guided by NIST SP 800-63B.

Definition

NIST SP 800-63B Revision 4 (2025) requires a minimum of 15 characters for single-factor passwords (8 when used with MFA), supports at least 64 characters, and prohibits forced composition rules and periodic rotation unless compromise is suspected. Passwords must be screened against breached and common-password blocklists. Account lockout or throttling limits online guessing.

Example

An organization drops 90-day password expiration and checks new passwords against a breached-password list.

Exam tip

Modern guidance favors length and blocklists over complexity and forced rotation; older exams may still mention complexity.

Related terms