Not accredited. Assurance authority: none; self-asserted by the contributing author. Endorsement: none.
Theoretical component. It describes a configuration that satisfies the named controls when applied; it is not an assertion that any particular system is running it. An SSP leveraging this component must supply the implementation evidence for its own hosts.
Assurance state is 'technically-tested': the configuration was applied to a clean Debian 13 install and verified end to end. It has NOT been independently assessed, and is not endorsed or accredited by the ACSC, NIST, or any assessment authority.
Debian 13 ISM Predictable Construction Rules
The limbs of ism-1558 that a character-level rule can enforce: monotonic runs (maxsequence), repeated characters (maxrepeat) and account-derived strings (usercheck, gecoscheck).
The word count itself is enforced by debian-13-pam-wordcount, and whether words were randomly selected is not something any available module can determine. Depends on debian-13-pwquality-base.
These are predictability constraints, not character-class complexity requirements, so they do not conflict with ism-2080.
Purpose. Reject predictable passphrase constructions on local Debian accounts.
Properties
| os-distribution | debian |
|---|
| os-release | 13 |
|---|
| os-codename | trixie |
|---|
| setting | pwquality:maxrepeat |
|---|
| setting | pwquality:maxsequence |
|---|
| setting | pwquality:usercheck |
|---|
| setting | pwquality:usersubstr |
|---|
| setting | pwquality:gecoscheck |
|---|
The character-level limbs of the ISM word-sequence control, as published in the ACSC ISM OSCAL catalogue release v2026.09.4.
ISM-1558 — Password strength
Partially implemented. maxsequence = 4 rejects monotonic runs, maxrepeat = 3 rejects repeated characters, and usercheck, usersubstr and gecoscheck reject strings derived from the account itself.
NOT ENFORCED here: the minimum word count, which debian-13-pam-wordcount enforces and which depends on this family. Nor is word provenance: a sequence of categorised words, a real sentence in natural language, and song lyrics or quotes all satisfy the rules above while being exactly what this control prohibits. Verified: all three are still accepted.
Residual risk Only the character-level limbs are enforced here. The word count is debian-13-pam-wordcount’s, and natural-language sentences, lyrics and categorised word lists remain accepted.
Configuration and scripts