# Strong password policy is enforced

- Source: https://support.icompaas.com/support/solutions/articles/a_1781206689617463-strong-password-policy-is-enforced
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Identity Provider (IDP)](https://support.icompaas.com/support/solutions/c_1781206270516942) › [Google Workspace](https://support.icompaas.com/support/solutions/folders/f_178120654326249)
- Last updated: 2026-06-12
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:  
This control ensures that a strong password policy is enforced for all users within the Google Workspace organization. Strong password requirements help protect user accounts from unauthorized access by requiring complex passwords that are resistant to guessing, brute-force attacks, and credential compromise.

  

Rationale:  
Weak passwords are a common cause of account compromise. Enforcing strong password requirements reduces the likelihood of unauthorized access and helps protect organizational resources from credential-based attacks.

  

Impact:

-   Reduces the risk of unauthorized access due to weak passwords.
    
-   Improves overall account security.
    
-   Supports compliance requirements related to identity and access management.
    
-   Helps protect organizational resources from credential-based attacks.
    
-   May require users to update passwords to meet policy requirements.
    

  

Default Value:  
Google Workspace provides default password settings, but administrators must explicitly configure password requirements to align with organizational security policies.

  

Remediation

Test Plan

1.  Sign in to the Google Admin console with administrative privileges.
    
2.  Navigate to Security → Password management.
    
3.  Review the configured password policy settings.
    
4.  Verify that password requirements are configured according to organizational policy.
    
5.  Attempt to create or change a user password that does not meet the configured requirements.
    
6.  Verify that the weak password is rejected.
    
7.  Verify that users are required to use passwords that comply with the configured policy.
    
8.  If strong password requirements are not configured or enforced, follow the Implementation Plan to remediate the issue and repeat the test.
    

  

Implementation Steps:

1.  Sign in to the Google Admin console with Super Administrator privileges.
    
2.  Navigate to Security → Password management.
    
3.  Select the applicable organizational unit.
    
4.  Configure the minimum password length according to organizational policy.
    
5.  Enable password strength enforcement settings where applicable.
    
6.  Configure password expiration settings according to organizational requirements.
    
7.  Configure password reuse restrictions according to organizational requirements.
    
8.  Apply the password policy to all applicable organizational units.
    
9.  Click Save to apply the configuration changes.
    
10.  Verify that users are required to create passwords that comply with the configured policy.
     

  

Backout Plan:

1.  Sign in to the Google Admin console with Super Administrator privileges.
    
2.  Navigate to Security → Password management.
    
3.  Select the applicable organizational unit.
    
4.  Modify the password policy settings as required.
    
5.  Click Save to apply the configuration changes.
    
6.  Verify that password requirements reflect the updated configuration.
    

  

References:

-   [Google Workspace Password Management Documentation](https://support.google.com/a/answer/139399)
    
-   [Google Workspace Password Policies Documentation](https://support.google.com/a/answer/7587183)
    
-   [Google Workspace Security Best Practices Documentation  
      
    ](https://support.google.com/a/answer/7587183)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.