Part Applicable Systems Requirements Measures 5.5 High Impact BES Cyber Systems For password-only authentication Examples of evidence may include, but and their associated: for interactive user access, either are not limited to: technically or procedurally System-generated reports or enforce the following password PACS; and screen-shots of the parameters: PCA enforced password parameters, Password length that is, including length and complexity; Medium Impact BES Cyber at least, the lesser of or Systems and their associated: eight characters or the Attestations that include a maximum length reference to the documented EACMS; supported by the Cyber procedures that were followed. PACS; and Asset; and PCA Minimum password complexity that is the lesser of three or more different types of characters (e.g., uppercase alphabetic, lowercase alphabetic, numeric, or the maximum complexity supported by the Cyber Asset. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the location where evidence of compliance may be found. File Name Document Revision Document Relevant Description of Applicability or Date Page(s) of Document Version or Section(s) Team Evidence Reviewed (This section to be completed by the Compliance Monitor Administrator): Compliance Assessment Approach Specific to Part 5.5 This section to be completed by the Compliance Monitor Administrator For password-only authentication for interactive user access, verify the Responsible Entity has
Part Applicable Systems Requirements Measures 5.5 High Impact BES Cyber Systems and their associated: PACS; and PCA Medium Impact BES Cyber Systems and their associated: EACMS; PACS; and PCA For password-only authentication for interactive user access, either technically or procedurally enforce the following password parameters: Password length that is, at least, the lesser of eight characters or the maximum length supported by the Cyber Asset; and Minimum password complexity that is the lesser of three or more different types of characters (e.g., uppercase alphabetic, lowercase alphabetic, numeric, or the maximum complexity supported by the Cyber Asset. Examples of evidence may include, but are not limited to: System-generated reports or screen-shots of the password parameters, including length and complexity; or Attestations that include a reference to the documented procedures that were followed. Registered Entity Response (Required): Describe, in narrative form, how you meet compliance with this requirement. Registered Entity Evidence (Required): The following information is requested for each document submitted as evidence. Also, evidence submitted should be highlighted and bookmarked, as appropriate, to identify the location where evidence of compliance may be found. File Name Document Revision or Version Document Date Relevant Page(s) or Section(s) Description of Applicability of Document Team Evidence Reviewed (This section to be completed by the Compliance Monitor Administrator): Compliance Assessment Approach Specific to Part 5.5 This section to be completed by the Compliance Monitor Administrator For password-only authentication for interactive user access, verify the Responsible Entity has enforced