# Ensure IAM password policy requires passwords to be at least 14 characters long

- Source: https://support.icompaas.com/support/solutions/articles/a_1790698514531902-ensure-iam-password-policy-requires-passwords-to-be-at-least-14-characters-long
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Oracle Cloud](https://support.icompaas.com/support/solutions/c_1790697859097233) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790697878907807)
- Last updated: 2026-09-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure the identity domain password policy that applies to users requires a minimum password length of at least 14 characters. Longer passwords are much harder to guess or crack, and current CIS guidance favors length over complex character rules.

**Rationale**

Short passwords can be cracked quickly with brute-force and dictionary attacks, especially when attackers use lists of common passwords. Requiring at least 14 characters greatly increases the number of possible passwords and makes these attacks far less practical. This protects Console accounts, especially those without MFA.

**Impact**

-   New and changed passwords must be at least 14 characters
    
-   Makes brute-force attacks much harder
    
-   Users may need to choose longer passwords
    

**Default Value**

By default, the identity domain password policy requires fewer than 14 characters, so it must be changed to a custom policy to meet this check.

**Pre-Requisites**

-   Identity domain administrator role
    

**Test Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).
    
3.  Select the Domain policies tab (or Settings > Password policy on some consoles), and select the password policy that applies to your users.
    
4.  Check the Password length (minimum) value.
    
5.  If it is less than 14, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).
    
3.  Select the Domain policies tab (or Settings > Password policy on some consoles), and select the password policy that applies to your users.
    
4.  Select Edit password rules and choose Custom.
    
5.  Set Password length (minimum) to 14 or more.
    
6.  Select Save changes. In the dialog, optionally select Force all users to set a new password on their next login, and select Save changes again.
    

**Backout Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).
    
3.  Select the Domain policies tab (or Settings > Password policy on some consoles), and select the password policy that applies to your users.
    
4.  Select Edit password rules and choose Custom.
    
5.  Set Password length (minimum) back to its previous value and select Save changes.
    

**Reference**

-   [https://docs.oracle.com/en-us/iaas/Content/Identity/passwordpolicies/modify-custom-password-policy.htm](https://docs.oracle.com/en-us/iaas/Content/Identity/passwordpolicies/modify-custom-password-policy.htm)
    
-   [https://docs.oracle.com/en-us/iaas/Content/Identity/passwordpolicies/listing-password-policies.htm](https://docs.oracle.com/en-us/iaas/Content/Identity/passwordpolicies/listing-password-policies.htm)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.