Not accredited. Assurance authority: none; self-asserted by the contributing author. Endorsement: none.
Theoretical component. It describes a configuration that satisfies the named controls when applied; it is not an assertion that any particular system is running it. An SSP leveraging this component must supply the implementation evidence for its own hosts.
Assurance state is 'technically-tested': the configuration was applied to a clean Debian 13 install and verified end to end. It has NOT been independently assessed, and is not endorsed or accredited by the ACSC, NIST, or any assessment authority.
Debian 13 ISM Minimum Passphrase Length
The ISM minimum password length for the system's applicability, enforced by pam_pwquality: 15 characters on non-classified, OFFICIAL: Sensitive and PROTECTED systems, 17 on SECRET and 20 on TOP SECRET. One drop-in per applicability, exactly one live at a time.
Depends on debian-13-pwquality-base. Pair it with debian-13-pwquality-no-complexity as well: with character-class credits enabled, a shorter password can satisfy the minimum, which the verification script tests for.
Purpose. Enforce the ISM minimum password length on local Debian accounts.
Properties
| os-distribution | debian |
|---|
| os-release | 13 |
|---|
| os-codename | trixie |
|---|
| setting | pwquality:minlen |
|---|
The ISM minimum password length, by applicability, as published in the ACSC ISM OSCAL catalogue release v2026.09.4.
ISM-0421 — Password strength
pam_pwquality enforces a minimum passphrase length of 15 characters on non-classified, OFFICIAL: Sensitive and PROTECTED systems, via the drop-in 50-ism-minlen-nc-os-p.conf.
Verified by behaviour: the shortest passphrase the live policy accepts is measured, and nothing shorter than 15 characters is accepted. A 14-character candidate using every character class is also rejected, which shows credits are not lowering the minimum.
Remarks
ISM applicability for this control is limited to the codes in its applicability props, which match the pinned catalogue. Deploying the drop-in for a different tier would assert a different control (ism-0421, ism-1557, or ism-0422); the apply script removes every other ISM drop-in so two minimum lengths can never be live at once.
Configuration and scripts
ISM-1557 — Password strength
pam_pwquality enforces a minimum passphrase length of 17 characters on SECRET systems, via the drop-in 50-ism-minlen-s.conf.
Verified by behaviour on a SECRET-tier system: nothing shorter than 17 characters is accepted.
Remarks
ISM applicability for this control is limited to the codes in its applicability props, which match the pinned catalogue. Deploying the drop-in for a different tier would assert a different control (ism-0421, ism-1557, or ism-0422); the apply script removes every other ISM drop-in so two minimum lengths can never be live at once.
Configuration and scripts
ISM-0422 — Password strength
pam_pwquality enforces a minimum passphrase length of 20 characters on TOP SECRET systems, via the drop-in 50-ism-minlen-ts.conf.
Verified by behaviour on a TOP SECRET-tier system: nothing shorter than 20 characters is accepted.
Remarks
ISM applicability for this control is limited to the codes in its applicability props, which match the pinned catalogue. Deploying the drop-in for a different tier would assert a different control (ism-0421, ism-1557, or ism-0422); the apply script removes every other ISM drop-in so two minimum lengths can never be live at once.
Configuration and scripts