Password complexity requirements are not imposed for passwords.
ISM-2080
Password strength
Australian Cyber Security Centre · Information Security Manual v2026.09.4 · Applicability NC, OS, P, S, TS
Components addressing ISM-2080
implemented Applicability claimed: NC, OS, P, S, TS
Implemented. dcredit, ucredit, lcredit and ocredit are all 0, so no character class earns credit and none is required; minclass = 0 imposes no class-count floor.
Verified by behaviour: an all-lowercase passphrase at the minimum length in force is accepted, which shows length alone governs.
Configuration and scripts
- config/pwquality.conf.d/50-ism-no-complexity.conf No complexity requirement
sha256 00be92183836d76e209184750f0abbfb9ad1c801b35f4d4a5db22b579413b26c - scripts/verify-no-complexity.sh Verification script
sha256 3b119c4f1067d183fc7480c7536aebfbdd7d365ef2536ea4aa1382748171a228
This control's implementations as an OSCAL component definition (newest version of each component)