# ISM password policy — minimum length, applicability NC, OS, P
#
# Source: ACSC ISM OSCAL catalogue v2026.09.4
#   ism-0421  single-factor passwords are a minimum of 15 characters  (NC, OS, P)
#
# This is a pure character count: debian-13-pwquality-no-complexity sets every
# credit to 0, so no character class can earn back a character against it. Without
# that component, credits could let a shorter password satisfy this minimum.
#
# Exactly one minimum may be live: pwquality.conf.d is read in ASCII sort order and
# a second minlen would silently win. The apply script removes the other two.
#
# Install to /etc/security/pwquality.conf.d/50-ism-minlen-nc-os-p.conf

minlen = 15