Ensure Password Policy Enforces Length and Rotation

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

For pre-upgrade environments: 1. Sign in as a Security Administrator or IT Security Manager. 2. Navigate to Tools, Security Console, Administration, Password Policy. 3. Verify that: Minimum length is ≥ 14 characters. Password expiration is ≤ 365 days. Password reuse prevention is ≥ 5 previous passwords. Account lockout triggers after ≤ 5 failed login attempts. For EPM and post-upgrade environments (OCI IAM Identity Domain): 1. In the OCI Console, go to Identity & Security, Domains, Security, Password Policy. 2. Confirm the equivalent settings: Minimum length ≥ 14.

How it is fixed

Fix method: Guidance or infrastructure patch

Pre-upgrade (Security Console): 1. Navigate to Navigator Tools, Security Console, Administration, Password Policy. 2. Configure the following values: Minimum Length: 14 Require Numbers: No Require Special Characters: No Password Expiration (Days): 365 Prevent Reuse of Last Passwords: 5 Failed Sign-In Attempts Before Lockout: 5 3. Save and communicate changes to all users. EPM & Post-upgrade (OCI IAM Identity Domain): 1. In the OCI Console, open the Identity Domain Security, Password Policy. 2. Configure equivalent parameters for length, complexity, expiration, reuse prevention, and lockout. 3. Save policy updates; they take immediate effect for all users.