Policy 7230A - Department of Administration

four: upper case letters, lower case letters, numbers,
and special characters.
o Very low and low risk systems must have passwords at
least six characters in length that make use of two of
the four: upper case letters, lower case letters,
numbers, and special characters.
• Where tokens, smart cards or other physical devices are used
as authenticators they must be sourced from reputable
manufacturers.
4.1.1.d User ID and Authenticator Lifespan Management
• User IDs must have a minimum lifespan equivalent to the term
of affiliation with the agency.
• Authenticators must have a lifespan according to the risk
categorization of the system:
o Very high and high risk systems must have passwords
with a maximum lifespan of thirty days, a minimum
lifespan of thirty days and a repeat frequency of twelve
passwords.
o Medium risk systems must have passwords with a
maximum lifespan of sixty days, a minimum lifespan of
thirty days and a repeat frequency of eight passwords.
o Very low and low risk systems must have passwords
with a maximum lifespan of ninety days, a minimum
lifespan of fifteen days and a repeat frequency of four
passwords.
4.2. Account Management
No applicable Mandatory Baselines.
4.3. Session Management
No applicable Mandatory Baselines.
4.4. Maintain Records
Agencies must capture documentation appropriate to all access control processes:
• Document and retain copies of issued user identifiers and authenticators.
Mandatory Baselines
Page 8 of 25