As of Kernel patch XU*8.0*180, Access and Verify codes adhere to the following strong must criteria: Access and Verify codes be identical. cannot Verify codes (i.e., passwords) be at least 8 characters in length. A of 15 must minimum characters is and may be enforced at a later date. recommended, Strong passwords in general contain at least three of the following four character types: Uppercase letters Lowercase letters Numbers Special characters/symbols that are neither letters nor numbers (e.g., #, &, $, *, -, _, @) NOTE: The caret (^) is a reserved symbol and be used as part of a cannot Verify code. Also, some systems restrict certain special non-VistA-based characters/symbols used as part of a username or password. Because VistA is case-insensitive, VistA only has three sets of characters from which to build a strong Verify code (i.e., password): Letters (of any case) Numbers Special characters/symbols that are neither letters nor numbers (e.g., #, &, $, *, -, _, @) NOTE: Some systems restrict certain special non-VistA-based characters/symbols used as part of a username or password. Verify codes be changed at least every 90 days (or less). You change your must must Verify code at periodic intervals as specified by the system administrators. Information systems shall permit re-assignment of the last three passwords used. When required, not you are prompted during signon to pick a new Verify code. REF: For more information on Verify code expiration dates, see Section 3.1.2.9, LIFETIME OF VERIFY CODE.” Accounts that have been inactive for 90 days shall be disabled. To preclude password guessing, an intruder lockout feature shall suspend accounts after five invalid attempts to log on: Where around-the-clock system administration service is available, system administrator intervention shall be required to clear a locked account. Where around-the-clock system administration service is available, accounts shall not remain locked out for at least ten minutes. NOTE: These rules are taken from the VA Account and Password Management Interim document. Policy
As of Kernel patch XU*8.0*180, strong Access and Verify codes must adhere to the following criteria: Access and Verify codes cannot be identical. Verify codes (i.e., passwords) must be at least 8 characters in length. A minimum of 15 characters is recommended, and may be enforced at a later date. Strong passwords in general contain at least three of the following four character types: Uppercase letters Lowercase letters Numbers Special characters/symbols that are neither letters nor numbers (e.g., -, _, #, &, $, *, @) NOTE: The caret (^) is a reserved symbol and cannot be used as part of a Verify code. Also, some non-VistA-based systems restrict certain special characters/symbols used as part of a username or password. Because VistA is case-insensitive, VistA only has three sets of characters from which to build a strong Verify code (i.e., password): Letters (of any case) Numbers Special characters/symbols that are neither letters nor numbers (e.g., -, _, #, &, $, *, @) NOTE: Some non-VistA-based systems restrict certain special characters/symbols used as part of a username or password. Verify codes must be changed at least every 90 days (or less). You must change your Verify code at periodic intervals as specified by the system administrators. Information systems shall not permit re-assignment of the last three passwords used. When required, you are prompted during signon to pick a new Verify code. REF: For more information on Verify code expiration dates, see Section 3.1.2.9, LIFETIME OF VERIFY CODE.” Accounts that have been inactive for 90 days shall be disabled. To preclude password guessing, an intruder lockout feature shall suspend accounts after five invalid attempts to log on: Where around-the-clock system administration service is available, system administrator intervention shall be required to clear a locked account. Where around-the-clock system administration service is not available, accounts shall remain locked out for at least ten minutes. NOTE: These rules are taken from the VA Account and Password Management Interim Policy document.