Use Unique Passwords
Description
Use unique passwords for all enterprise assets. Best practice implementation includes, at a minimum, an 8-character password for accounts using MFA and a 14-character password for accounts not using MFA.
Implementation Checklist
Tool Recommendations
Privileged access management platform for securing, managing, and auditing privileged credentials and sessions
CyberArk · Per-user subscription
Privileged access management with endpoint privilege management, secure remote access, and password vaulting
BeyondTrust · Per-user subscription
Privileged access management with password vaulting, session recording, and just-in-time privilege elevation
Delinea · Per-user subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Credential Stuffing Attacks Using Breached Passwords
ConfidentialityAttackers use credentials leaked from third-party breaches to access enterprise accounts where employees reused the same password across personal and work systems.
Password Spraying with Common Weak Passwords
ConfidentialityAttackers perform password spraying attacks using common passwords like 'Spring2026!' that meet basic complexity rules but are predictable, compromising multiple accounts simultaneously.
Offline Password Cracking of Stolen Hashes
ConfidentialityAttackers who obtain password hashes crack short or simple passwords rapidly using GPU-accelerated brute force or rainbow tables, gaining access to accounts with weak passwords.
Vulnerabilities (When Safeguard Absent)
Weak or Reused Passwords Across Enterprise Accounts
Without unique password requirements and minimum length enforcement, users choose weak, predictable, or previously compromised passwords that are easily guessed or cracked.
No Password Policy Enforcement Mechanism
Without technical controls enforcing password length and uniqueness requirements, users default to the shortest, simplest, most memorable passwords possible.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Technical | MFA enrollment status and enforcement configuration | Reviewed monthly |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |