# NIST 800-171 3.5.7 Enforce a minimum password complexity and change of characters when new passwords are created.

- Source: https://support.icompaas.com/support/solutions/articles/62000229295-nist-800-171-3-5-7-enforce-a-minimum-password-complexity-and-change-of-characters-when-new-passwords-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST](https://support.icompaas.com/support/solutions/62000112528) › [800-171](https://support.icompaas.com/support/solutions/folders/62000168440)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:**   

This requirement applies to single-factor authentication of individuals using passwords as individual or group authenticators, and in a similar manner, when passwords are used as part of multifactor authenticators. The number of changed characters refers to the number of changes required with respect to the total number of positions in the current password. To mitigate certain brute force attacks against passwords, organizations may also consider salting passwords. 

  

**Priority**: High   

  

**Category**: Centralized Controls Management 

  

**Services Associated with AWS:**   

-   AWS Identity and Access Management (IAM) 

  

**Objective Evidence:**   

-   Administrative: documented policies, standards & procedures
-   Administrative: supporting documentation to demonstrate how Identity & Access Management (IAM) practices are implemented
-   Administrative: supporting documentation to demonstrate the "secure practices" used to build technology platform-specific secure baseline configurations
-   Technical: screenshot of configuration settings 

  

Possible Technology Considerations : 

-   Identity & Access Management (IAM)
-   Secure Baseline Configurations (SBC) 

  

**What needs to be answered :**  

Does the company specify a degree of complexity including minimum requirements for each type? Does the company require a different password when new passwords are created?

-   Enforce Password Complexity and Change  
    Description: This check ensures that organizations enforce minimum password complexity and require the change of characters when new passwords are created. Password complexity refers to the requirements for the composition of passwords, such as the use of a combination of uppercase and lowercase letters, numbers, and special characters. Requiring the change of characters means that a certain number of characters must be changed when creating a new password, compared to the previous password. These measures help strengthen password security and mitigate the risk of unauthorized access through brute force attacks. Organizations should establish password complexity policies and define the minimum complexity requirements and password change frequency based on industry best practices and security guidelines. 

  

**More Details:**   

Comprehensive password policies are in place via the company cybersecurity handbook and employee training.

## Related compliance guidance

- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): How the 800-53 catalogue, baselines and the Risk Management Framework fit together, and which controls take the most work in the cloud.
- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): If the driver is a DoD or federal contract handling CUI, 800-171 (and CMMC) is the scope you actually need.