IA-5.1: Password-based Authentication

the frequency at which to update the list of commonly used, expected, or compromised passwords is defined;

authenticator composition and complexity rules are defined;