Password Policy Assessment

Passwords are influenced by multiple risk factors. The strength of a password is not determined by a single characteristic, but by how length, uniqueness, reuse, exposure, and authentication context collectively reduce the likelihood of compromise.

Consistent with NIST SP 800-63B guidance, organizations should prioritize longer passphrases, screen passwords against known compromised or commonly used values, avoid password reuse across systems, leverage single sign-on (SSO) where feasible to reduce credential sprawl, and enforce multi-factor authentication (MFA) to significantly reduce credential-based attack risk.

This is a risk-weighted password maturity assessment (1–4). MFA + Screening are weighted highest; Storage + Reset are medium; Complexity is intentionally lower impact.