Control: ism-0421; Revision: 8; Updated: Dec-21; Applicability: ALL; Essential Eight: N/A ​

Passphrases used for single-factor authentication are at least 4 random words with a total minimum length of 14 characters, unless more stringent requirements apply.