NIST 800-171 Controls · Identification & Authentication

IA.2.082 — Enforce minimum password complexity and change of characters

CMMC Level 2SPRS if unmet: -3HIGH priority~3h to implement

Enforce a minimum password complexity and change of characters when new passwords are created.

What IA.2.082 means in plain English

Passwords must meet minimum strength requirements: a mix of uppercase letters, lowercase letters, numbers, and symbols — and they must be long enough that they are hard to guess. NIST now recommends focusing on length over complexity: a 12-14 character minimum with at least one number and one symbol is the sweet spot. The "change of characters" requirement means a new password must be meaningfully different from the old one — not just changing one character. For your team, configure Windows password policy and Microsoft 365 password policy to enforce these rules automatically.

The assessment question

“Is a minimum password complexity standard (length, character variety, change-of-character requirements) technically enforced on all systems — not just documented in policy?”

How to implement IA.2.082

Set Windows password policy via Group Policy (Computer Configuration > Windows Settings > Security Settings > Account Policies > Password Policy): minimum 12 characters, complexity enabled (forces mixed character types).
In Microsoft 365 Admin Center, configure password expiration and complexity settings under Settings > Org Settings > Security & Privacy > Password Policy.
Configure the "minimum password age" to at least 1 day and "enforce password history" to 24 passwords to prevent immediate recycling.
Consider adopting a passphrase standard (e.g., four random words: "purple-table-canyon-7") which is long, complex, and memorable — document this in your Password Policy.
Deploy Bitwarden or similar password manager so employees can handle complex passwords without writing them down.

Evidence your assessor will ask for

Group Policy Object screenshot showing minimum password length (12+) and complexity enabled
Microsoft 365 password policy screenshot
Written Password Policy document specifying complexity requirements
Screenshot of password history setting (24 generations recommended)

Does AI prompt monitoring help with this control? Honestly, no.

IA.2.082 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.

Full mapping: which 800-171 controls AI prompt monitoring evidences →