IA-5.1: Password-based Authentication

authenticator composition and complexity rules are defined;

the frequency at which to update the list of commonly used, expected, or compromised passwords is defined;