Password composition requirements must be enforced

Control Statement: The instance must enforce documented password composition requirements across at least one character class beyond lower-case letters.

Description: Creatio expresses password composition through four system settings, each specifying a minimum count of characters of a given class: MinPasswordLowercaseCharCount, MinPasswordUppercaseCharCount, MinPasswordNumericCharCount and MinPasswordSpecialCharCount. This control requires that the organisation’s documented composition policy be expressed in these settings, and that at least one class beyond lower-case letters be required.

Rationale: Composition requirements are a weaker control than length, and current guidance generally favours length and reuse prevention over elaborate composition rules. They are included here at Moderate risk for a narrower reason: where an organisation has a documented password policy, the instance should actually enforce it rather than merely assert it. A policy that exists only in a document and is contradicted by the running configuration is worse than no policy, because it produces false assurance during review — and this is the common case, since these four settings must each be configured separately and are easy to configure partially.

Audit Procedure:

1. Obtain the organisation’s documented password composition policy.
2. Open System Designer → System settings.
3. Record the configured values of MinPasswordLowercaseCharCount, MinPasswordUppercaseCharCount, MinPasswordNumericCharCount and MinPasswordSpecialCharCount.
4. Record the instance as non-compliant where the configured values do not implement the documented policy, or where no class beyond lower-case letters is required.
5. Where authentication is delegated to an external identity provider, verify the equivalent policy at that provider instead.

Remediation:

1. Express the documented composition policy as values for the four settings.
2. Configure each setting, including those the policy sets to zero, so the configuration is explicit rather than inherited.
3. Verify enforcement by attempting to set a non-conforming password on a test account.

Default Value: Creatio treats these values as organisation-dependent and does not document the values the settings carry before configuration. An instance where they have never been configured should be assumed to enforce no composition requirement until verified on the instance.