> For the complete documentation index, see [llms.txt](/docs/llms.txt)

# Password Security Compliance Checklist | FusionAuth Docs

Use this combined checklist of leading password recommendations to strengthen your company's password security policy, meet compliance standards, and minimize the risk of data theft.

# Password Security Compliance Checklist

By Bryan Giese

![Password Security Compliance Checklist](/img/icons/password-compliance-checklist.svg)

Right or wrong, usernames and passwords have been a critical component of website and application security for years. However, weak passwords can result in a costly data breach if compromised. To help ensure stronger password security, leading organizations like the National Institute for Standards and Technology have published clear criteria to discourage users from selecting easy to guess passwords. We have assembled those criteria into one checklist of key password recommendations to help you evaluate and improve your own password policies, and to help initiate critical conversations with your engineering, security, and governance teams.

## Legally Required Password Constraints[#](#legally-required-password-constraints)

According to [Verizon's Data Breach Investigations Report](https://enterprise.verizon.com/resources/reports/dbir/), 81% of hacking-related breaches took advantage of stolen and/or weak passwords. Financial, healthcare, and public sector organizations accounted for half of those breaches. With over four billion credentials stolen in 2019 and the [impact of a data breach averaging $3.86 million](https://www.forbes.com/sites/niallmccarthy/2018/07/13/the-average-cost-of-a-data-breach-is-highest-in-the-u-s-infographic/) per incident, password strength has emerged as an effective strategy to benefit overall security. In fact, many organizations are required by law to enforce strict password constraints and requirements. These password requirements are based on extensive study of the mathematical principles of password entropy and are proven to construct stronger passwords. They combine a variety of strategies including:

*   Minimum and maximum character counts
*   Uppercase and lowercase letter requirements
*   Numeric and special character requirements
*   Time-based password resets
*   Password re-use policies

You can use the following checklist to keep track of your compliance with each of the standards. Anything you check off will be saved in local storage, so you can come back later and pick up where you left off.

### FDA (U.S. Food and Drug Administration)[#](#fda-us-food-and-drug-administration)

The FDA regulates food, drugs, biologics, medical devices, electronic products (that give off radiation), cosmetics, veterinary products, and tobacco products.

*   At least 8, but no more than 32 characters
*   At least one uppercase letter
*   At least one lowercase letter
*   At least one special characters
*   At least one number
*   Passwords must be changed every 90 days

### HIPAA (Health Insurance Portability and Accountability Act)[#](#hipaa-health-insurance-portability-and-accountability-act)

Any organization that deals with protected health information (PHI) must ensure HIPAA compliance.

*   At least 6, preferably 8, characters in length
*   Combination of uppercase and lowercase letters, mixed with numbers and symbols
*   Passwords should be changed every 45 to 90 days
*   Cannot be the same as any of the user's last 12 passwords

### PCI DSS (Payment Card Industry Data Security Standard)[#](#pci-dss-payment-card-industry-data-security-standard)

Any organization that deals with payment card data must be PCI compliant-whether payment card processing is the company's primary function or not.

*   At least 7 characters
*   Have a mix of both letters and numbers
*   Passwords must be changed every 90 days
*   Cannot be the same as any of the user's last four passwords

### SOC2 (Service Organization Control)[#](#soc2-service-organization-control)

Established by the AICPA (American Institute of CPAs), SOC 2 applies to all companies using the cloud to store customers' information.

*   At least 8 characters in length
*   Lower and uppercase letters
*   One number
*   One symbol

### NIST (United States National Institute for Standards and Technology)[#](#nist-united-states-national-institute-for-standards-and-technology)

Updated in 2019, NIST produces guidelines to help federal agencies meet the requirements of the FISMA (Federal Information Security Management Act), however other organizations reference NIST for strong security standards. The NIST guidelines were updated in 2019. NIST sets the precedence and these standards often trickle down to other regulations such as HIPAA and SOC. It is likely there will be a shift in favor of password length and user friendliness.

*   Minimum of 8 characters when a human sets it
*   Minimum of 6 characters when set by a system or service
*   Maximum length no less than 64 characters (higher maximums are okay)
*   Support all ASCII characters (including space)
*   No mandatory password changes
*   No special character requirement
*   Passwords checked against known breached lists
*   Passwords checked against common dictionaries
*   No truncation of passwords during processing
*   No password hints
*   No recovery questions (i.e. mother's maiden name)

## Conclusion[#](#conclusion)

Password security is a vital part of compliance and helps organizations protect user data and maintain customer trust. While these password requirements won't eliminate all your password issues, they will go a long way to make your system more secure from the most common hacking attacks. Be sure your identity solution has built-in capabilities to help you stay up-to-date with frequently changing password compliance requirements. It will help strengthen password security, keep your customer information secure, and keep your business thriving.