Agencies must implement a password policy that enforces a minimum length of 16 characters (for example four words). Every password must be long, strong and unique: it must meet the minimum length and be built from unique random words, characters or numbers. No explicit complexity rule (such as mandatory numbers or special characters) is imposed, but passwords must be unique or random, and they may use numbers and special characters to achieve that.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.