id: supplemental_password_policy
title: "Password Policy Supplemental"
discussion: |
  To comply with Executive Order 14028, “Improving the Nation's Cybersecurity”, OMB M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, and NIST SP-800-63b, “Digital Identity Guidelines: Authentication and Lifecycle Management” federal, military, and intelligence communities must adopt the following configuration settings: 
    
    * Password policies must not require the use of complexity policies such as upper characters, lower characters, or special characters. 
    * Password policies must also not require the use of regular rotation. 
  
  In accordance with these requirements, the following rules, while they remain on specific benchmarks, have been removed from any of the NIST 800-53r5 baselines as recommendations.

    * pwpolicy_alpha_numeric_enforce
    * pwpolicy_custom_regex_enforce
    * pwpolicy_lower_case_character_enforce.yaml
    * pwpolicy_max_lifetime_enforce
    * pwpolicy_minimum_lifetime_enforce
    * pwpolicy_prevent_dictionary_words
    * pwpolicy_simple_sequence_disable
    * pwpolicy_special_character_enforce
    * pwpolicy_upper_case_character_enforce.yaml

  If an organization has requirements to implement additional password policies, the remainder of this supplemental discusses the following password policy rules:

    * pwpolicy_lower_case_character_enforce
    * pwpolicy_upper_case_character_enforce
    * pwpolicy_account_inactivity_enforce
    * pwpolicy_minimum_lifetime_enforce

  Password policies should be enforced as much as possible via Configuration Profiles. However, the following policies are currently not enforceable via Configuration Profiles, and must therefore be enabled using the `pwpolicy` command:

    * Enforcing at least 1 lowercase character
    * Enforcing at least 1 uppercase character
    * Disabling an account after 35 days of inactivity
    * Password minimum lifetime

  To set the local policy to meet these requirements, save the following XML password policy to a file.

  [source,xml]
  ----
  include::../../includes/pwpolicy.xml[]
  ----

  Run the following command to load the new policy file, substituting the path to the file in place of "$pwpolicy_file".

  [source,bash]
  ----
  /usr/bin/pwpolicy setaccountpolicies $pwpolicy_file
  ----

  [NOTE]
  ====
  If directory services is being utilized, password policies should come from the domain.
  ====

  [WARNING]
  ====
  In order to apply any password policy, the `allowPasscodeModification` setting in `com.apple.applicationaccess` must not be set to `false`.
  ====

check: |
fix: |
references:
  cci:
    - N/A
  800-53r5:
    - N/A
  800-53r4:
    - N/A
  srg:
    - N/A
  disa_stig:
    - N/A
  cmmc:
    - N/A
macOS:
  - '15.0'
tags:
  - 800-171
  - 800-53r4_high
  - 800-53r4_low
  - 800-53r4_moderate
  - 800-53r5_high
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_privacy
  - cis_lvl1
  - cis_lvl2
  - cisv8
  - cmmc_lvl1
  - cmmc_lvl2
  - cnssi-1253_high
  - cnssi-1253_moderate
  - cnssi-1253_low
  - stig
  - supplemental
mobileconfig: false
mobileconfig_info: