Topic starter
11/07/2026 8:31 pm
TL;DR: NIST SP 800-63B-4 reworks password expectations by dropping composition rules, requiring only 15 characters for single-factor passwords, and making phishing-resistant authenticators central to higher assurance, according to Cybertrust Japan’s summary of the revision. The shift matters because it moves IAM programmes from complexity rules toward authenticator strength, recovery discipline, and resistance to modern attack methods.
Editorial analysis by NHI Mgmt Group, based on content published by Cybertrust Japan: “NIST ã®ææ°ã¬ã¤ãã©ã¤ã³ã«è¦ããèªè¨¼ã¨ãã¹ã¯ã¼ããã®æ°å¸¸è”.
Key questions
Q: What should security teams do first when password complexity rules are still in place?
A: Start by removing composition requirements, periodic forced changes, and other rules that create predictable behaviour without improving resistance to attack.
Q: Why do password-only controls fall short for high-assurance access?
A: Password-only controls fail because they prove knowledge, not durable identity assurance.
Q: How do teams know whether MFA is actually meeting AAL2 or AAL3 expectations?
A: Check the actual factors in use, not the MFA label.
Practitioner guidance
- Remove composition rules from password policy Replace mixed-character and periodic-change rules with minimum length, blocklists, and monitoring for compromised passwords.
- Classify user journeys by assurance level Map administrative, financial, and privileged workflows to the assurance level they actually require, then check whether the current authenticator mix can satisfy AAL2 or AAL3.
- Review recovery and reset paths Audit password reset, step-up, and fallback mechanisms for phishing resistance, because weak recovery can nullify strong primary authentication.
Bottom line: NIST SP 800-63B-4 moves password governance away from symbolic complexity and toward actual resistance to guessing, phishing, and replay.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:00 pm
Password complexity is now a weak security signal: The old assumption was that mixing symbols, numbers, and case creates meaningful resistance to attack. That assumption fails because users predictably game the rule, and attackers already know how to exploit predictable human patterns. The implication is that password policy should be judged by resistance to guessing, phishing, and replay, not by symbolic complexity.
A question worth separating out:
Q: What is the difference between password policy and authenticator assurance?
A: Password policy governs how secrets are created and managed. Authenticator assurance describes how much confidence the organisation has that the presented authenticator belongs to the enrolled user. In practice, assurance is the stronger concept because it includes phishing resistance, recovery design, and the full authentication journey.
👉 Read our full editorial: NIST SP 800-63B-4 changes how password policy should be judged