• Passwords must be changed at least every 90 days – critical systems and Administrator accounts require changes at least every 60 days.

• Passwords must have a minimum length of 8 alphanumeric characters.

• Passwords must contain a mix of upper and lower case characters and have at least 2 numeric characters. The numeric characters must not be at the beginning or end of the password. Special characters should be included in the password where the computing system permits. The special characters are (!@#$%^&*_+=?/~`;:,<>|\).

• Passwords must not be easy to guess and should be resistant to brute force and dictionary type attacks against them.

Sample Passwords:

eAt42peN

l!v3f1Sh

J@n3Sm!th

Other Requirements:

Can not be repeated from the past 3 usages

Should NOT be a "word"