{
  "component-definition": {
    "uuid": "64495a0a-ee1c-5801-a63d-0d7e05868b9b",
    "metadata": {
      "title": "ISM-1558 Password strength: implementations in the OSCAL Ops Library",
      "last-modified": "2026-09-16T02:00:55Z",
      "version": "0.1.0",
      "oscal-version": "1.1.2",
      "props": [
        {
          "name": "library-view",
          "ns": "https://oscalops.net/ns/library",
          "value": "control-implementations"
        },
        {
          "name": "catalog-release",
          "ns": "https://oscalops.net/ns/library",
          "value": "6f037e85-d69c-5606-874e-1d986ef561a9"
        },
        {
          "name": "control-id",
          "ns": "https://oscalops.net/ns/library",
          "value": "ism-1558"
        }
      ],
      "links": [
        {
          "href": "https://library.oscalops.net/catalogs/acsc-ism/v2026.09.4/controls/ism-1558.json",
          "rel": "canonical"
        }
      ],
      "roles": [
        {
          "id": "system-administrator",
          "title": "System Administrator"
        },
        {
          "id": "system-security-officer",
          "title": "System Security Officer"
        }
      ],
      "parties": [
        {
          "uuid": "1b4346aa-044e-4e42-a524-53d40f60f879",
          "type": "organization",
          "name": "Platform Operations"
        }
      ],
      "remarks": "A derived view: the implemented requirements for ISM-1558 in Information Security Manual v2026.09.4, copied from the newest version of each component definition that addresses it. Each component's source-document property names that version in back matter. Edit the source component definitions, not this view."
    },
    "components": [
      {
        "uuid": "d5fd110b-962b-4b6f-b64e-b972c6d19567",
        "type": "software",
        "title": "Debian 13 ISM word-count enforcement (pam_ism_wordcount)",
        "description": "Enforces the ism-1558 minimum word count for passwords that are a sequence of words: at least 4 words on non-classified, OFFICIAL: Sensitive and PROTECTED systems, 5 on SECRET and 6 on TOP SECRET. Single-token passwords are passed through untouched, which is what lets ism-1558 and ism-2080 hold together.\n\nThe default implementation is pam_ism_wordcount.so, a purpose-built PAM module that counts whitespace-delimited words in one read-only, in-process pass. A pam_exec(8) shell equivalent is shipped as a fallback for hosts that cannot deploy a compiled module.\n\nDepends on debian-13-pwquality-base. The check reads the new password but never asks for it; pam_pwquality, earlier in the stack, obtains it. Without it pam-auth-update still gives pam_unix use_authtok, there is no token to use, and every password change fails: verified on a clean Debian 13 install. The apply script refuses to run without pam_pwquality in the stack.",
        "purpose": "Enforce the ISM word-count requirement for passphrases on local Debian accounts without imposing a complexity requirement on single-token passwords.",
        "props": [
          {
            "name": "os-distribution",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "debian"
          },
          {
            "name": "os-release",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "13"
          },
          {
            "name": "os-codename",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "trixie"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "pam-auth-update:ism-wordcount-module"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "pam-auth-update:ism-wordcount"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "pam-module:pam_ism_wordcount.so"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "file:/usr/local/sbin/ism-wordcount-check"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "file:/etc/security/ism-wordcount.conf"
          },
          {
            "name": "enforcement-mechanism",
            "ns": "https://ns.oscalops.net/component-definitions/debian-13-pam-wordcount",
            "value": "pam_ism_wordcount.so (in-process, default) or pam_exec.so running ism-wordcount-check (fallback)"
          },
          {
            "name": "dependency-posture",
            "ns": "https://ns.oscalops.net/component-definitions/debian-13-pam-wordcount",
            "value": "No packages beyond libpam-pwquality, libpwquality-tools and cracklib-runtime; pam_exec ships in libpam-modules. libpam-python and libpam-script were evaluated and rejected."
          },
          {
            "name": "pam-stack-priority",
            "ns": "https://ns.oscalops.net/component-definitions/debian-13-pam-wordcount",
            "value": "1020 (after pam_pwquality at 1024, ahead of pam_unix at 256)"
          },
          {
            "name": "additional-packages-required",
            "ns": "https://ns.oscalops.net/component-definitions/debian-13-pam-wordcount",
            "value": "none at runtime; building the module needs libpam0g-dev and a C compiler on a build host"
          },
          {
            "name": "source-document",
            "ns": "https://oscalops.net/ns/library",
            "value": "d96586ff-46d4-5ae2-b1a3-4088f1703fdf"
          }
        ],
        "links": [
          {
            "href": "#61822038-eb12-4200-95d7-2c99575d5195",
            "rel": "depends-on",
            "text": "pam_pwquality obtains the new password this check reads"
          }
        ],
        "responsible-roles": [
          {
            "role-id": "system-administrator",
            "party-uuids": [
              "1b4346aa-044e-4e42-a524-53d40f60f879"
            ]
          },
          {
            "role-id": "system-security-officer",
            "party-uuids": [
              "1b4346aa-044e-4e42-a524-53d40f60f879"
            ]
          }
        ],
        "control-implementations": [
          {
            "uuid": "46fa7608-c11c-4c78-9d84-e7b8652b6182",
            "source": "https://raw.githubusercontent.com/AustralianCyberSecurityCentre/ism-oscal/v2026.09.4/ISM_catalog.json",
            "description": "The ISM word-count requirement, as published in the ACSC ISM OSCAL catalogue release v2026.09.4.",
            "props": [
              {
                "name": "catalog-release",
                "ns": "https://ns.oscalops.net/component-definitions",
                "value": "v2026.09.4"
              },
              {
                "name": "catalog-authority",
                "ns": "https://ns.oscalops.net/component-definitions",
                "value": "Australian Cyber Security Centre"
              },
              {
                "name": "control-family",
                "ns": "https://ns.oscalops.net/component-definitions",
                "value": "Guidelines for system access > Credential management > Password strength"
              }
            ],
            "links": [
              {
                "href": "#36c41fd6-4e7c-4dbf-92bc-604bf58f40f1",
                "rel": "reference",
                "text": "Pinned ISM catalogue release"
              }
            ],
            "implemented-requirements": [
              {
                "uuid": "5fe1d36a-2dea-4167-a57c-e4358ead47d3",
                "control-id": "ism-1558",
                "description": "Partially implemented. This component enforces the word-count limb. Sequences, repeats and account-derived strings are rejected by debian-13-pam-pwquality; the provenance limbs are not enforced by any component.\n\nENFORCED, verified by behaviour through the PAM stack on all three applicability tiers: a password using a sequence of words must use at least 4 words on non-classified, OFFICIAL: Sensitive and PROTECTED systems, 5 on SECRET and 6 on TOP SECRET. This is implemented by pam_ism_wordcount.so, a purpose-built PAM module that counts whitespace-delimited words in a single read-only pass. It runs in-process, so the candidate never leaves the PAM process. A pam_exec(8) shell equivalent is shipped as a fallback for hosts that cannot deploy a compiled module; pam_exec ships in libpam-modules, so neither route requires an additional package.\n\nCrucially, the check applies ONLY to passwords that are a sequence of words. A single-token password is not one, so it is passed through untouched. That is what allows this control and ism-2080 to hold simultaneously; see the remarks for why a character-class module cannot.\n\nNOT ENFORCED: a sequence of categorised words, a real sentence in natural language, and song lyrics, quotes or other publicly available material all satisfy a word count while being exactly what this control prohibits. Verified: all three are still accepted. Determining whether words were randomly selected is not something any available module can do.",
                "props": [
                  {
                    "name": "implementation-status",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "partial"
                  },
                  {
                    "name": "applicability",
                    "ns": "https://cyber.gov.au/ns/ism/oscal/3.0",
                    "value": "NC"
                  },
                  {
                    "name": "applicability",
                    "ns": "https://cyber.gov.au/ns/ism/oscal/3.0",
                    "value": "OS"
                  },
                  {
                    "name": "applicability",
                    "ns": "https://cyber.gov.au/ns/ism/oscal/3.0",
                    "value": "P"
                  },
                  {
                    "name": "applicability",
                    "ns": "https://cyber.gov.au/ns/ism/oscal/3.0",
                    "value": "S"
                  },
                  {
                    "name": "applicability",
                    "ns": "https://cyber.gov.au/ns/ism/oscal/3.0",
                    "value": "TS"
                  },
                  {
                    "name": "correlates-nist-statement",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "ia-5.1_smt.h"
                  },
                  {
                    "name": "correlation-strength",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "narrower"
                  },
                  {
                    "name": "assessment-method",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "examine"
                  },
                  {
                    "name": "assessment-frequency",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "annual"
                  },
                  {
                    "name": "residual-risk",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "Word count is enforced; randomness and provenance of the words are not. Natural-language sentences, lyrics and categorised word lists remain accepted."
                  }
                ],
                "links": [
                  {
                    "href": "#51799d81-e8a9-5fbe-a93c-3c77e3e85e2f",
                    "rel": "reference",
                    "text": "ism-1558 word-count check"
                  },
                  {
                    "href": "#4458d8f2-7275-50d0-bddc-1f1b5af4544e",
                    "rel": "reference",
                    "text": "pam-auth-update profile for the word-count check"
                  },
                  {
                    "href": "#4a83f138-8d1f-5580-afc6-afca5f91c3ef",
                    "rel": "reference",
                    "text": "pam_ism_wordcount source"
                  },
                  {
                    "href": "#0a472c7c-c5ba-5d12-81ca-13fa1b4ca2a7",
                    "rel": "reference",
                    "text": "pam-auth-update profile for the in-process module"
                  },
                  {
                    "href": "#1e0249c8-b96c-4bc8-a191-a2c0bd135f72",
                    "rel": "reference",
                    "text": "Verification script"
                  }
                ],
                "responsible-roles": [
                  {
                    "role-id": "system-security-officer",
                    "party-uuids": [
                      "1b4346aa-044e-4e42-a524-53d40f60f879"
                    ]
                  }
                ],
                "remarks": "Why not pam_passwdqc: it can enforce a word count, but passwdqc requires each min value to be no larger than the preceding one, so 'disabled' can only ever apply to the weakest character-class tiers. It can therefore never express 'reject all non-passphrases regardless of class'. Tested: under min=disabled,disabled,15,15,15 with passphrase=4 a two-word candidate is correctly rejected, but a 15-character single-token password is ALSO rejected -- which breaches ism-2080, since ism-1558 governs only passwords using a sequence of words. passwdqc's min is additionally an effective length rather than a raw character count, so it cannot assert the literal 'minimum of 15 characters' that ism-0421 states.\n\nThe pam_exec approach keys off word structure instead, which is what the control actually describes, and leaves single-token passwords alone.\n\nImplementation choice: a purpose-built C module is the default because it removes the only real exposure of the shell route, where expose_authtok passes the cleartext candidate across a pipe to a child process. The module reads PAM_AUTHTOK in-process and the candidate is never copied, logged, or passed to another process.\n\nC rather than Rust: the check is a single read-only pass counting whitespace transitions, with no allocation, no copying and no index arithmetic, so the memory-safety hazards C is criticised for are absent rather than merely managed. A Rust module would still require #[no_mangle] extern \"C\" and an unsafe read of a raw *const c_char from pam_get_item, placing unsafe code at exactly the point of risk, while adding a rustc build dependency and a much larger artefact. The source is 91 lines and compiles clean under -Wall -Wextra -Werror; the resulting object is roughly 15 kB and links only libpam and libc.\n\nAlternatives evaluated and rejected: libpam-python would also run in-process but depends on libpython3.13 and installs 11 packages including the full CPython standard library, linking a Python interpreter into sshd, login, sudo and cron; its Debian changelog records 'Fix CVE-2019-16729 again' in 2024, five years after the original. libpam-script uses the same external script model as pam_exec and so changes nothing.\n\nThe pam_exec fallback, where used, is hardened: pinned to type=password, ulimit -c 0 so a credential cannot reach a core file, umask 077, the shell read builtin rather than a command substitution so no second process holds the cleartext, and no branch that logs or passes the candidate as a command argument.\n\nResidual mitigation: pwqgen(1) or pwmake(1) generate passphrases so users never select words themselves, which is the only practical answer to the provenance limbs."
              }
            ]
          }
        ]
      },
      {
        "uuid": "787b6f80-2be0-482c-a4d2-a2a34a9875f6",
        "type": "software",
        "title": "Debian 13 ISM Predictable Construction Rules",
        "description": "The limbs of ism-1558 that a character-level rule can enforce: monotonic runs (maxsequence), repeated characters (maxrepeat) and account-derived strings (usercheck, gecoscheck).\n\nThe word count itself is enforced by debian-13-pam-wordcount, and whether words were randomly selected is not something any available module can determine. Depends on debian-13-pwquality-base.\n\nThese are predictability constraints, not character-class complexity requirements, so they do not conflict with ism-2080.",
        "purpose": "Reject predictable passphrase constructions on local Debian accounts.",
        "props": [
          {
            "name": "os-distribution",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "debian"
          },
          {
            "name": "os-release",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "13"
          },
          {
            "name": "os-codename",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "trixie"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "pwquality:maxrepeat"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "pwquality:maxsequence"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "pwquality:usercheck"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "pwquality:usersubstr"
          },
          {
            "name": "setting",
            "ns": "https://ns.oscalops.net/component-definitions",
            "value": "pwquality:gecoscheck"
          },
          {
            "name": "source-document",
            "ns": "https://oscalops.net/ns/library",
            "value": "fde3df45-e6aa-57fc-9d36-348e54844f5e"
          }
        ],
        "links": [
          {
            "href": "#fb64bf12-ed42-4f21-a0e4-46fbcb8cfc6b",
            "rel": "depends-on",
            "text": "pam_pwquality must be installed and enforcing"
          }
        ],
        "responsible-roles": [
          {
            "role-id": "system-administrator",
            "party-uuids": [
              "1b4346aa-044e-4e42-a524-53d40f60f879"
            ]
          }
        ],
        "control-implementations": [
          {
            "uuid": "6b244643-df8e-4056-9deb-f55558c51789",
            "source": "https://raw.githubusercontent.com/AustralianCyberSecurityCentre/ism-oscal/v2026.09.4/ISM_catalog.json",
            "description": "The character-level limbs of the ISM word-sequence control, as published in the ACSC ISM OSCAL catalogue release v2026.09.4.",
            "props": [
              {
                "name": "catalog-release",
                "ns": "https://ns.oscalops.net/component-definitions",
                "value": "v2026.09.4"
              },
              {
                "name": "catalog-authority",
                "ns": "https://ns.oscalops.net/component-definitions",
                "value": "Australian Cyber Security Centre"
              },
              {
                "name": "control-family",
                "ns": "https://ns.oscalops.net/component-definitions",
                "value": "Guidelines for system access > Credential management > Password strength"
              }
            ],
            "links": [
              {
                "href": "#36c41fd6-4e7c-4dbf-92bc-604bf58f40f1",
                "rel": "reference",
                "text": "Pinned ISM catalogue release"
              }
            ],
            "implemented-requirements": [
              {
                "uuid": "c0db7985-3646-4a14-a7cd-9c35c33182c0",
                "control-id": "ism-1558",
                "description": "Partially implemented. maxsequence = 4 rejects monotonic runs, maxrepeat = 3 rejects repeated characters, and usercheck, usersubstr and gecoscheck reject strings derived from the account itself.\n\nNOT ENFORCED here: the minimum word count, which debian-13-pam-wordcount enforces and which depends on this family. Nor is word provenance: a sequence of categorised words, a real sentence in natural language, and song lyrics or quotes all satisfy the rules above while being exactly what this control prohibits. Verified: all three are still accepted.",
                "props": [
                  {
                    "name": "implementation-status",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "partial"
                  },
                  {
                    "name": "applicability",
                    "ns": "https://cyber.gov.au/ns/ism/oscal/3.0",
                    "value": "NC"
                  },
                  {
                    "name": "applicability",
                    "ns": "https://cyber.gov.au/ns/ism/oscal/3.0",
                    "value": "OS"
                  },
                  {
                    "name": "applicability",
                    "ns": "https://cyber.gov.au/ns/ism/oscal/3.0",
                    "value": "P"
                  },
                  {
                    "name": "applicability",
                    "ns": "https://cyber.gov.au/ns/ism/oscal/3.0",
                    "value": "S"
                  },
                  {
                    "name": "applicability",
                    "ns": "https://cyber.gov.au/ns/ism/oscal/3.0",
                    "value": "TS"
                  },
                  {
                    "name": "correlates-nist-statement",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "ia-5.1_smt.h"
                  },
                  {
                    "name": "correlation-strength",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "narrower"
                  },
                  {
                    "name": "assessment-method",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "test"
                  },
                  {
                    "name": "assessment-frequency",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "annual"
                  },
                  {
                    "name": "residual-risk",
                    "ns": "https://ns.oscalops.net/component-definitions",
                    "value": "Only the character-level limbs are enforced here. The word count is debian-13-pam-wordcount’s, and natural-language sentences, lyrics and categorised word lists remain accepted."
                  }
                ],
                "links": [
                  {
                    "href": "#80b0a78f-efc6-4579-8b30-a33db676a3e5",
                    "rel": "reference",
                    "text": "Predictability drop-in"
                  },
                  {
                    "href": "#bca6a4a6-fd1f-4501-af7d-9d66d1e07da8",
                    "rel": "reference",
                    "text": "Verification script"
                  }
                ],
                "responsible-roles": [
                  {
                    "role-id": "system-administrator",
                    "party-uuids": [
                      "1b4346aa-044e-4e42-a524-53d40f60f879"
                    ]
                  }
                ]
              }
            ]
          }
        ]
      }
    ],
    "back-matter": {
      "resources": [
        {
          "uuid": "6f037e85-d69c-5606-874e-1d986ef561a9",
          "title": "Information Security Manual",
          "props": [
            {
              "name": "version",
              "value": "v2026.09.4"
            },
            {
              "name": "library-item",
              "ns": "https://oscalops.net/ns/library",
              "value": "catalog-release"
            },
            {
              "name": "catalog-key",
              "ns": "https://oscalops.net/ns/library",
              "value": "acsc-ism"
            },
            {
              "name": "authority",
              "ns": "https://oscalops.net/ns/library",
              "value": "Australian Cyber Security Centre"
            },
            {
              "name": "licence",
              "ns": "https://oscalops.net/ns/library",
              "value": "CC-BY-4.0"
            },
            {
              "name": "controls",
              "ns": "https://oscalops.net/ns/library",
              "value": "1192"
            }
          ],
          "citation": {
            "text": "ISM OSCAL content from the Australian Signals Directorate's Australian Cyber Security Centre, provided under a Creative Commons Attribution 4.0 International licence, excluding the Coat of Arms and the ASD logo."
          },
          "rlinks": [
            {
              "href": "../ISM_catalog.json",
              "media-type": "application/oscal+json",
              "hashes": [
                {
                  "algorithm": "sha-256",
                  "value": "237ea09362b8449ed5c5ee85de4725a0468ee73d13af7cf61c26d4e6ac47f12d"
                }
              ]
            },
            {
              "href": "https://raw.githubusercontent.com/AustralianCyberSecurityCentre/ism-oscal/v2026.09.4/ISM_catalog.json",
              "media-type": "application/oscal+json",
              "hashes": [
                {
                  "algorithm": "sha-256",
                  "value": "237ea09362b8449ed5c5ee85de4725a0468ee73d13af7cf61c26d4e6ac47f12d"
                }
              ]
            }
          ]
        },
        {
          "uuid": "d96586ff-46d4-5ae2-b1a3-4088f1703fdf",
          "title": "Debian 13 ISM Word-Count Enforcement Component Definition",
          "description": "Enforces the ism-1558 minimum word count for passwords that are a sequence of words: at least 4 words on non-classified, OFFICIAL: Sensitive and PROTECTED…",
          "props": [
            {
              "name": "version",
              "value": "1.0.0"
            },
            {
              "name": "library-item",
              "ns": "https://oscalops.net/ns/library",
              "value": "component-definition-version"
            },
            {
              "name": "artifact-slug",
              "ns": "https://oscalops.net/ns/library",
              "value": "debian-13-pam-wordcount"
            },
            {
              "name": "publication-status",
              "ns": "https://oscalops.net/ns/library",
              "value": "unpublished"
            },
            {
              "name": "assurance-state",
              "ns": "https://oscalops.net/ns/library",
              "value": "technically-tested"
            },
            {
              "name": "source-kind",
              "ns": "https://oscalops.net/ns/library",
              "value": "local"
            }
          ],
          "rlinks": [
            {
              "href": "../../../../component-definitions/debian-13-pam-wordcount/1.0.0/component-definition.json",
              "media-type": "application/oscal+json",
              "hashes": [
                {
                  "algorithm": "sha-256",
                  "value": "ad9b64c03242c5fd9b2f74fe84c66dfaac8408471adcfa487bd002f4523e0515"
                }
              ]
            },
            {
              "href": "../../../../component-definitions/debian-13-pam-wordcount/1.0.0/index.html",
              "media-type": "text/html"
            }
          ]
        },
        {
          "uuid": "51799d81-e8a9-5fbe-a93c-3c77e3e85e2f",
          "title": "ism-1558 word-count check",
          "description": "Invoked by pam_exec from the password stack. Enforces the minimum word count for passwords that are a sequence of words, and passes single-token passwords through so ism-2080 is not breached.",
          "props": [
            {
              "name": "artifact-type",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "shell-script"
            }
          ],
          "rlinks": [
            {
              "href": "../../../../component-definitions/debian-13-pam-wordcount/1.0.0/scripts/ism-wordcount-check",
              "media-type": "text/plain"
            }
          ]
        },
        {
          "uuid": "4458d8f2-7275-50d0-bddc-1f1b5af4544e",
          "title": "pam-auth-update profile for the word-count check",
          "description": "Declarative PAM profile at priority 1020, so it stacks after pam_pwquality (1024) and length errors are reported first. Deploys to /usr/share/pam-configs/ism-wordcount.",
          "props": [
            {
              "name": "artifact-type",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "pam-config"
            }
          ],
          "rlinks": [
            {
              "href": "../../../../component-definitions/debian-13-pam-wordcount/1.0.0/config/pam-configs/ism-wordcount",
              "media-type": "text/plain"
            }
          ]
        },
        {
          "uuid": "4a83f138-8d1f-5580-afc6-afca5f91c3ef",
          "title": "pam_ism_wordcount source",
          "description": "The complete source of the word-count PAM module: 91 lines, single read-only pass, no allocation. Auditable in full.",
          "props": [
            {
              "name": "artifact-type",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "c-source"
            }
          ],
          "rlinks": [
            {
              "href": "../../../../component-definitions/debian-13-pam-wordcount/1.0.0/src/pam_ism_wordcount.c",
              "media-type": "text/plain"
            }
          ]
        },
        {
          "uuid": "0a472c7c-c5ba-5d12-81ca-13fa1b4ca2a7",
          "title": "pam-auth-update profile for the in-process module",
          "description": "Declarative PAM profile at priority 1020, stacking after pam_pwquality (1024). Deploys to /usr/share/pam-configs/ism-wordcount-module.",
          "props": [
            {
              "name": "artifact-type",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "pam-config"
            }
          ],
          "rlinks": [
            {
              "href": "../../../../component-definitions/debian-13-pam-wordcount/1.0.0/config/pam-configs/ism-wordcount-module",
              "media-type": "text/plain"
            }
          ]
        },
        {
          "uuid": "1e0249c8-b96c-4bc8-a191-a2c0bd135f72",
          "title": "Verification script",
          "description": "Checks the dependency, wiring and module architecture; with --with-test-account, exercises the word count through a real password change on a throwaway account and reports ism-1558.",
          "props": [
            {
              "name": "artifact-type",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "shell-script"
            }
          ],
          "rlinks": [
            {
              "href": "../../../../component-definitions/debian-13-pam-wordcount/1.0.0/scripts/verify-wordcount.sh",
              "media-type": "text/plain"
            }
          ]
        },
        {
          "uuid": "36c41fd6-4e7c-4dbf-92bc-604bf58f40f1",
          "title": "ACSC ISM OSCAL catalogue v2026.09.4",
          "description": "Australian Cyber Security Centre Information Security Manual OSCAL catalogue, release v2026.09.4: the release this document's control identifiers resolve against.",
          "props": [
            {
              "name": "release-tag",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "v2026.09.4"
            },
            {
              "name": "sha256",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "237ea09362b8449ed5c5ee85de4725a0468ee73d13af7cf61c26d4e6ac47f12d"
            }
          ],
          "rlinks": [
            {
              "href": "https://raw.githubusercontent.com/AustralianCyberSecurityCentre/ism-oscal/v2026.09.4/ISM_catalog.json",
              "media-type": "application/json"
            }
          ]
        },
        {
          "uuid": "61822038-eb12-4200-95d7-2c99575d5195",
          "title": "debian-13-pwquality-base component-definition",
          "description": "The component this one depends on: pam_pwquality obtains the new password that the word-count check reads.",
          "document-ids": [
            {
              "scheme": "https://ns.oscalops.net/component-definitions",
              "identifier": "debian-13-pwquality-base"
            }
          ],
          "rlinks": [
            {
              "href": "https://library.oscalops.net/component-definitions/debian-13-pwquality-base/1.0.0/component-definition.json",
              "media-type": "application/json"
            }
          ]
        },
        {
          "uuid": "fde3df45-e6aa-57fc-9d36-348e54844f5e",
          "title": "Debian 13 ISM Predictable Construction Rules Component Definition",
          "description": "The limbs of ism-1558 that a character-level rule can enforce: monotonic runs (maxsequence), repeated characters (maxrepeat) and account-derived strings…",
          "props": [
            {
              "name": "version",
              "value": "1.0.0"
            },
            {
              "name": "library-item",
              "ns": "https://oscalops.net/ns/library",
              "value": "component-definition-version"
            },
            {
              "name": "artifact-slug",
              "ns": "https://oscalops.net/ns/library",
              "value": "debian-13-pwquality-predictability"
            },
            {
              "name": "publication-status",
              "ns": "https://oscalops.net/ns/library",
              "value": "unpublished"
            },
            {
              "name": "assurance-state",
              "ns": "https://oscalops.net/ns/library",
              "value": "technically-tested"
            },
            {
              "name": "source-kind",
              "ns": "https://oscalops.net/ns/library",
              "value": "local"
            }
          ],
          "rlinks": [
            {
              "href": "../../../../component-definitions/debian-13-pwquality-predictability/1.0.0/component-definition.json",
              "media-type": "application/oscal+json",
              "hashes": [
                {
                  "algorithm": "sha-256",
                  "value": "f63812d41c809ad9764ea189f7e06e27fcc329d8c693131689ed3fc978ff8902"
                }
              ]
            },
            {
              "href": "../../../../component-definitions/debian-13-pwquality-predictability/1.0.0/index.html",
              "media-type": "text/html"
            }
          ]
        },
        {
          "uuid": "80b0a78f-efc6-4579-8b30-a33db676a3e5",
          "title": "Predictable construction rules",
          "description": "maxrepeat, maxsequence, usercheck, usersubstr and gecoscheck, asserting part of ism-1558. Deploys to /etc/security/pwquality.conf.d/50-ism-predictability.conf.",
          "props": [
            {
              "name": "artifact-type",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "pwquality-config"
            }
          ],
          "rlinks": [
            {
              "href": "../../../../component-definitions/debian-13-pwquality-predictability/1.0.0/config/pwquality.conf.d/50-ism-predictability.conf",
              "media-type": "text/plain"
            }
          ]
        },
        {
          "uuid": "bca6a4a6-fd1f-4501-af7d-9d66d1e07da8",
          "title": "Verification script",
          "description": "Asserts the control from behaviour, with every candidate padded to the minimum length in force, and reports separately if another configuration sets a setting this component owns.",
          "props": [
            {
              "name": "artifact-type",
              "ns": "https://ns.oscalops.net/component-definitions",
              "value": "shell-script"
            }
          ],
          "rlinks": [
            {
              "href": "../../../../component-definitions/debian-13-pwquality-predictability/1.0.0/scripts/verify-predictability.sh",
              "media-type": "text/plain"
            }
          ]
        },
        {
          "uuid": "fb64bf12-ed42-4f21-a0e4-46fbcb8cfc6b",
          "title": "debian-13-pwquality-base component-definition",
          "description": "The component this one depends on: pam_pwquality must be installed and enforcing, or nothing here is applied.",
          "document-ids": [
            {
              "scheme": "https://ns.oscalops.net/component-definitions",
              "identifier": "debian-13-pwquality-base"
            }
          ],
          "rlinks": [
            {
              "href": "https://library.oscalops.net/component-definitions/debian-13-pwquality-base/1.0.0/component-definition.json",
              "media-type": "application/json"
            }
          ]
        }
      ]
    }
  }
}