The agency has a written directive regarding the computer, record or information systems, either internal or external, that require password access and addresses:

1. 1. password construction;
   2. password changes at a minimum of every 90 days; and
   3. password access termination when employment status or position changes.

Commentary

A good practice is to have passwords of at least eight characters including at least one upper case, one lower case, one alpha, and one numeric. (M M M)