A minimum password length must be enforced

Control Statement: The instance must enforce a minimum password length of at least 8 characters.

Description: The MinPasswordLength system setting defines the shortest password a user may set. This control requires it to be configured to at least 8 characters. Organisations subject to a stricter internal policy must configure the higher value.

This control applies to accounts authenticating against Creatio’s own user directory. Where all authentication is delegated to an external identity provider, the control is satisfied by the equivalent policy at that provider, and the delegation must be recorded.

Rationale: Password length is the single parameter with the largest effect on resistance to guessing, and it is the one most often left unset because Creatio applies no minimum of its own. An instance that has never had this setting configured will accept passwords of trivial length, and this is not visible anywhere in the interface — no warning is shown to the administrator, and no indication is given to the user that the password they chose is weak by the organisation’s own standards.

Audit Procedure:

1. Open System Designer → System settings.
2. Locate the setting with code MinPasswordLength.
3. Record its configured value.
4. Record the instance as non-compliant if the value is unset, or lower than 8, or lower than the organisation’s documented policy.
5. Where authentication is delegated to an external identity provider, confirm the delegation is recorded and verify the equivalent policy at the provider instead.

Remediation:

1. Determine the required minimum length from the organisation’s password policy, using 8 characters as the floor.
2. Set MinPasswordLength to that value.
3. Confirm the change takes effect by attempting to set a shorter password on a test account.
4. Note that existing passwords are unaffected until they are next changed.

Default Value: Creatio’s guidance recommends a minimum of at least 8 characters but does not document the value the setting carries before an administrator configures it. Treat an unconfigured setting as not enforcing a minimum, and verify the effective behaviour on the instance rather than assuming a default.