Notifications
Clear all
Topic starter
11/07/2026 8:31 pm
TL;DR: NIST SP 800-63B-4 reworks password expectations by dropping composition rules, requiring only 15 characters for single-factor passwords, and making phishing-resistant authenticators central to higher assurance, according to Cybertrust Japan’s summary of the revision. The shift matters because it moves IAM programmes from complexity rules toward authenticator strength, recovery discipline, and resistance to modern attack methods.
NHIMG editorial — based on content published by Cybertrust Japan: NIST's latest guidance reframes password and authentication norms
By the numbers:
- 2025年は1月から9月までの9ヶ月間に、フィッシング対策協議会の公開情報をもとにした報告件数が2024年の年間報告件数を超え、200万件に迫る勢いとなっています。
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
Questions worth separating out
Q: How should organisations modernise password policy without weakening identity security?
A: They should stop treating password complexity as the main security control and move to a model based on length, breach screening, and authenticator assurance.
Q: When should teams replace passwords with phishing-resistant authentication?
A: They should do it wherever credential theft would create high operational, financial, or regulatory impact, especially for administrators and privileged workflows.
Q: What do security teams get wrong about password rotation?
A: They often assume frequent password changes improve security, but forced rotation can push users toward predictable patterns and weak workarounds.
Practitioner guidance
- Rebase password policy on assurance levels Use NIST assurance levels to decide where passwords alone remain acceptable and where stronger authenticators are mandatory for sensitive access.
- Remove composition rules that drive predictable behaviour Replace symbol, case, and forced-change mandates with minimum-length rules, breached-password screening, and stronger authentication methods.
- Harden account recovery and reset workflows Treat password reset, help desk verification, and fallback channels as part of the authentication control surface, not as an administrative afterthought.
What's in the full article
Cybertrust Japan's full post covers the operational detail this post intentionally leaves for the source:
- A side-by-side breakdown of the revised password requirements and the older assumptions they replace
- Explanation of how AAL1, AAL2, and AAL3 differ in practice for real deployment decisions
- Examples of phishing-resistant authentication methods and where they fit in current identity stacks
- The article's discussion of Japanese financial-sector guidance and how it aligns with the NIST revision
👉 Read Cybertrust Japan's analysis of NIST SP 800-63B-4 password guidance →
NIST password guidance shifts: are IAM controls ready for AAL3?
Explore further
11/07/2026 9:00 pm
Length-based password policy is now a hygiene control, not a security strategy. NIST’s revision reflects a simple reality: attackers win by capturing, replaying, or bypassing credentials, not by patiently brute-forcing well-formed passwords. The meaningful decision point is no longer whether a password contains symbols, but whether the authentication path can withstand phishing, reuse, and recovery abuse. Practitioners should treat password rules as one layer in a broader assurance model, not as the model itself.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, according to our Ultimate Guide to NHIs.
A question worth separating out:
Q: Who should own password recovery risk in an IAM programme?
A: IAM, service desk, and security operations should share accountability, because recovery flows are part of authentication, not separate administration. If reset steps can reissue access too easily, they become the easiest path around stronger login controls. Governance should therefore review recovery approval, identity proofing, and escalation paths as one control chain.
👉 Read our full editorial: NIST SP 800-63B-4 changes how password policy should be judged
