# CAIQ IAM-02: Strong password policy By The Citesheet team · Published October 20, 2026 Short answer IAM-02 asks whether you have a written strong-password policy that is approved and followed, and whether it is reviewed at least annually. A password policy or standard proves it: minimum length, no reuse, a password manager, and multi-factor authentication. Modern policies follow NIST and drop forced rotation, which is fine as long as the policy says so. IAM-02 is the CCM's password control. Like [IAM-01](https://citesheet.com/caiq/iam-01-identity-and-access-management-policy/), it is a "policy and procedures" control, so it is about having a written rule that people follow, not about one system setting. ## What the control asks * **IAM-02.1:** Are _strong password_ policies and procedures established, documented, approved, communicated, implemented, applied, evaluated and maintained? * **IAM-02.2:** Are they reviewed and updated at least annually? "Strong" is not defined in the question. Reviewers usually look for a minimum length, a ban on reuse and sharing, a password manager, and multi-factor authentication (MFA). Separate CAIQ controls cover MFA in depth (IAM-14) and password storage (IAM-15), but most companies prove all three from the same document. ## Which policy usually proves it A _Password Policy_ or _Password Standard_. In smaller companies it is often a section of the access control or acceptable use policy. Either is fine if it states actual rules. ## Quoted evidence from public policies GitLab's standard lists its settings as plain rules. Its requirements list starts with: > Minimum Length = 12 characters > > _GitLab Handbook, [GitLab Password Standards](https://handbook.gitlab.com/handbook/security/policies%5Fand%5Fstandards/password-standard/), CC BY-SA 4.0._ and the same standard makes MFA mandatory for production: > Usage of MFA by GitLab team members is **required** for access to the production environment. > > _GitLab Handbook, [GitLab Password Standards](https://handbook.gitlab.com/handbook/security/policies%5Fand%5Fstandards/password-standard/), CC BY-SA 4.0._ Tailscale's policy is short and specific: > Passwords must be generated using a password management service. > > Password length must be at least a 15 character minimum. > > _Tailscale, [Password policy](https://tailscale.com/security-policies/password), CC0._ and it covers IAM-02.2 in the same document: > Tailscale’s Security team is responsible for reviewing and updating the Password requirements on an annual basis. > > _Tailscale, [Password policy](https://tailscale.com/security-policies/password), CC0._ PostHog's handbook is a good example of a policy written for people, not auditors: > All team members are required to enable multi-factor authentication (MFA) on their accounts. > > _PostHog Handbook, [Security & Privacy](https://posthog.com/handbook/company/security), MIT._ ## How GitLab answered GitLab answered **Yes** to IAM-02.1 and IAM-02.2 in its CAIQ v4.0.3 submission on the [CSA STAR Registry](https://cloudsecurityalliance.org/star/registry/services/gitlab), and linked its password standard and password guidelines. ## A good answer, if your policy supports it > **IAM-02.1: Yes.** Our Password Policy requires passwords of at least \[N\] characters, generated and stored in \[password manager\], never reused or shared, and MFA on every system that supports it. SSO is used where available. See Password Policy, "Requirements". Note what is _not_ in that answer: forced rotation every 90 days. [NIST SP 800-63B-4](https://pages.nist.gov/800-63-4/sp800-63b.html) says verifiers "SHALL NOT require subscribers to change passwords periodically." GitLab's standard sets "Password expiration = No" (except for systems where a password is the only factor), and Tailscale's says passwords "do not need to be regularly rotated". If your policy drops rotation, say so plainly. A buyer's checklist that expects rotation can then see it is a deliberate choice. ## When N/A is honest Rarely. Even a company that uses SSO for everything has passwords somewhere: the identity provider, the password manager, break-glass accounts and devices. If you truly have no passwords for the in-scope service (for example, only hardware-key sign-in), answer Yes or No about the policy that covers that, and explain. Don't answer N/A. ## Where answers usually go wrong * **Quoting the wrong scope.** Tailscale's policy says it does not apply to its customers' passwords. A staff password policy proves IAM-02 for your staff, not for your product's end users. Some questionnaires ask about both. * **The annual review again.** As with IAM-01, "reviewed at least annually" needs its own sentence or record. ## How Citesheet handles it In an earlier run on our [benchmark](https://citesheet.com/benchmark/) labelled set (the "v2" rules), IAM-02.1 got the right value, but with a quote different from the one in our label. The quote may be just as good; we list it as a miss until a person checks it. Every Citesheet answer shows its quote, so that check takes seconds. ## Sources 1. [Cloud Security Alliance: Cloud Controls Matrix (CCM)](https://cloudsecurityalliance.org/ccm/) (accessed October 20, 2026) 2. [CSA STAR Registry: GitLab.com (CAIQ v4.0.3 submission, 2025-03-25)](https://cloudsecurityalliance.org/star/registry/services/gitlab) (accessed October 20, 2026) 3. [GitLab Handbook: GitLab Password Standards (CC BY-SA 4.0)](https://handbook.gitlab.com/handbook/security/policies%5Fand%5Fstandards/password-standard/) (accessed October 20, 2026) 4. [Tailscale security policies: Password policy (CC0)](https://tailscale.com/security-policies/password) (accessed October 20, 2026) 5. [PostHog Handbook: Security & Privacy (MIT)](https://posthog.com/handbook/company/security) (accessed October 20, 2026) 6. [NIST SP 800-63B-4: Digital Identity Guidelines, Authentication and Authenticator Management](https://pages.nist.gov/800-63-4/sp800-63b.html) (accessed October 20, 2026) ## Related * [CAIQ IAM-01: Identity and access management policyWhat CAIQ v4 control IAM-01 asks, which policy proves it, quoted examples from GitLab and Tailscale, and when the annual review question needs care.](https://citesheet.com/caiq/iam-01-identity-and-access-management-policy/) * [CAIQ IAM-05: Least privilegeCAIQ v4 control IAM-05 asks whether people and systems get only the access they need. What proves it, quoted examples from Tailscale, GitLab and PostHog, and gaps.](https://citesheet.com/caiq/iam-05-least-privilege/) * [We tested Citesheet on GitLab's public CAIQHow Citesheet did on a 261-question CAIQ filled only from GitLab's public policies: what matched, what it refused, what it got wrong, and the limits.](https://citesheet.com/benchmark/) ## Send one questionnaire. See the proof. First questionnaire free. Same-day turnaround. Tell us where to send it back and we'll reply with next steps. Send your first questionnaire free Takes about 15 seconds. Or email [hello@citesheet.com](mailto:hello@citesheet.com). Need an NDA first? Ask, and we'll sign before you send anything.