Passwords used for single-factor authentication on TOP SECRET systems are a minimum of 20 characters.
ISM-0422
Password strength
Australian Cyber Security Centre · Information Security Manual v2026.09.4 · Applicability TS
Components addressing ISM-0422
implemented Applicability claimed: TS
pam_pwquality enforces a minimum passphrase length of 20 characters on TOP SECRET systems, via the drop-in 50-ism-minlen-ts.conf.
Verified by behaviour on a TOP SECRET-tier system: nothing shorter than 20 characters is accepted.
Configuration and scripts
- config/pwquality.conf.d/50-ism-minlen-ts.conf Minimum length, applicability TS
sha256 45ee91bcb5d114c18f4b302cc8449060fb159af88c0c1ab532b456858f39ff66 - scripts/verify-minlen.sh Verification script
sha256 010aa56c327cc1e28d05a0acf4ba8c47f6fdfdb2784b301a33edad87f1497fd8
This control's implementations as an OSCAL component definition (newest version of each component)