Part 5.5 in AR5 Part 5.5 Please For password-only authentication for interactive provide: user access, verify the Responsible Entity has Table R5 System Access Controls – documented one or more processes to either Applicable Systems technically or procedurally enforce the following One or more High Impact BES cyber systems and their associated: password parameters: documented processes 1. electronic access control or monitoring systems; password length that is, at the pertaining to 2. physical access control systems; and lesser of eight characters or the requirement R5 Part 3. protected cyber assets maximum length supported by the 5.5. cyber asset; and Medium Impact BES cyber systems and their associated: minimum password complexity that is 1. electronic access control or monitoring systems; the lesser of three or more different 2. physical access control systems; and types of characters (e.g., uppercase alphabetic, lowercase alphabetic, 3. protected cyber assets numeric, non-alphanumeric) or the maximum complexity supported by the cyber asset. Requirements For password‐only authentication for interactive user access, either technically or procedurally enforce the following password parameters: 5.5.1. password length that is, at least, the lesser of eight characters or the maximum length supported by the cyber asset; and 5.5.2. minimum password complexity that is the lesser of three or more different types of characters (e.g., uppercase alphabetic, lowercase alphabetic, numeric, nonalphanumeric) or the maximum complexity supported by For each of Applicable Systems, the cyber asset cyber asset Evidence that the for password-only authentication for interactive processes pertaining to user access, verify password length is enforced requirement R5 Part by either technical or procedural methods, per 5.5 have been Measures 5.5.1. implemented. Examples of evidence may include, but are not limited to: For each cyber asset of Applicable Systems, system‐generated reports or screen‐shots of the for password-only authentication for interactive system enforced password parameters, including user access, verify password complexity is length and complexity; or enforced by either technical or procedural attestations that include a reference to the methods, per 5.5.2. documented procedures that were followed.
Part 5.5 in Table R5 – System Access Controls Applicable Systems High Impact BES cyber systems and their associated: 1. electronic access control or monitoring systems; 2. physical access control systems; and 3. protected cyber assets Medium Impact BES cyber systems and their associated: 1. electronic access control or monitoring systems; 2. physical access control systems; and 3. protected cyber assets Requirements For password‐only authentication for interactive user access, either technically or procedurally enforce the following password parameters: 5.5.1. password length that is, at least, the lesser of eight characters or the maximum length supported by the cyber asset; and 5.5.2. minimum password complexity that is the lesser of three or more different types of characters (e.g., uppercase alphabetic, lowercase alphabetic, numeric, nonalphanumeric) or the maximum complexity supported by the cyber asset Measures Examples of evidence may include, but are not limited to: system‐generated reports or screen‐shots of the system enforced password parameters, including length and complexity; or attestations that include a reference to the documented procedures that were followed. AR5 Part 5.5 Please provide: One or more documented processes pertaining to requirement R5 Part 5.5. For password-only authentication for interactive user access, verify the Responsible Entity has documented one or more processes to either technically or procedurally enforce the following password parameters: password length that is, at the lesser of eight characters or the maximum length supported by the cyber asset; and minimum password complexity that is the lesser of three or more different types of characters (e.g., uppercase alphabetic, lowercase alphabetic, numeric, non-alphanumeric) or the maximum complexity supported by the cyber asset. Evidence that the processes pertaining to requirement R5 Part 5.5 have been implemented. For each cyber asset of Applicable Systems, for password-only authentication for interactive user access, verify password length is enforced by either technical or procedural methods, per 5.5.1. For each cyber asset of Applicable Systems, for password-only authentication for interactive user access, verify password complexity is enforced by either technical or procedural methods, per 5.5.2.