Control: ism-1559; Revision: 2; Updated: Mar-22; Applicability: ALL; Essential Eight: N/A ​

Memorised secrets used for multi-factor authentication are a minimum of 6 characters, unless more stringent requirements apply.