The institution shall identify system users, processes acting on behalf of users, and devices.
The institution shall authenticate (or verify) the identities of users, processes, or devices as a prerequisite to allowing access to institutional systems.
The institution shall enforce a minimum password complexity and change of characters when new passwords are created.
The institution shall allow temporary password to use for system logons with an immediate change to a permanent password.
