Password Policy

5 min

1. Purpose

The CQA Password Policy defines the standards for creating, managing, and securing user passwords. This policy is designed to mitigate the risk of unauthorized access, brute-force attacks, and credential stuffing while maintaining a user-friendly experience that aligns with modern security standards (including NIST 800-63B guidelines).

2. Scope

This policy applies to all accounts accessing the CQA platform, including Tenant Administrators, Supervisors, Agents, and API system accounts.

3. Password Construction Requirements

All user-generated passwords must adhere to the following mandatory criteria:

3.1. Length Requirements

Minimum Length: 12 characters.

Maximum Length: 128 characters.

Rationale: Longer passwords provide exponentially greater resistance against brute-force and dictionary attacks. Allowing up to 128 characters easily accommodates passphrases.

3.2. Character Complexity

Passwords must contain characters from at least three (3) of the following four (4) categories:

Uppercase alphabetical characters (A-Z)

Lowercase alphabetical characters (a-z)

Numeric characters (0-9)

Special characters and symbols (e.g., ! @ # $ % ^ & * ( ) - _ = + [ ] { } ; : , . < > / ?)

3.3. Allowed Characters

The system supports all UTF-8 characters.

Users are explicitly permitted to use spaces (allowing for multi-word passphrases) and all standard ASCII and non-ASCII symbols.

3.4. Contextual Restrictions

Username/Email Match: Passwords are cross-checked against the user's account data. A password will be immediately rejected if it contains the user's username, first name, last name, or email address (evaluated as a case-insensitive substring match).

Security Parameter	Requirement	Description / Rule
Minimum Length	12 Characters	Passwords must be at least 12 characters long.
Maximum Length	128 Characters	Passwords can be up to 128 characters to easily accommodate long passphrases.
Complexity Requirements	3 out of 4 Categories	Passwords must contain characters from at least 3 of the following 4 categories: • Uppercase letters (A-Z) • Lowercase letters (a-z) • Numbers (0-9) • Special characters/symbols (e.g., !@#$%^&*)
Allowed Characters	All UTF-8 Characters	All standard characters, symbols, and spaces are explicitly allowed and encouraged.
Contextual Restrictions	No Username/Email	Passwords cannot contain the user's account username, first name, last name, or email address (case-insensitive).
Usability & Tools	Paste Functionality Enabled	The system fully supports copy/pasting.