CAIQ IAM-02: Strong password policy

IAM-02 is the CCM's password control. Like IAM-01, it is a "policy and procedures" control, so it is about having a written rule that people follow, not about one system setting.

What the control asks

• IAM-02.1: Are strong password policies and procedures established, documented, approved, communicated, implemented, applied, evaluated and maintained?
• IAM-02.2: Are they reviewed and updated at least annually?

"Strong" is not defined in the question. Reviewers usually look for a minimum length, a ban on reuse and sharing, a password manager, and multi-factor authentication (MFA). Separate CAIQ controls cover MFA in depth (IAM-14) and password storage (IAM-15), but most companies prove all three from the same document.

Which policy usually proves it

A Password Policy or Password Standard. In smaller companies it is often a section of the access control or acceptable use policy. Either is fine if it states actual rules.

Quoted evidence from public policies

GitLab's standard lists its settings as plain rules. Its requirements list starts with:

Minimum Length = 12 characters

GitLab Handbook, GitLab Password Standards, CC BY-SA 4.0.

and the same standard makes MFA mandatory for production:

Usage of MFA by GitLab team members is required for access to the production environment.

GitLab Handbook, GitLab Password Standards, CC BY-SA 4.0.

Tailscale's policy is short and specific:

Passwords must be generated using a password management service.

Password length must be at least a 15 character minimum.

Tailscale, Password policy, CC0.

and it covers IAM-02.2 in the same document:

Tailscale’s Security team is responsible for reviewing and updating the Password requirements on an annual basis.

Tailscale, Password policy, CC0.

PostHog's handbook is a good example of a policy written for people, not auditors:

All team members are required to enable multi-factor authentication (MFA) on their accounts.

PostHog Handbook, Security & Privacy, MIT.

How GitLab answered

GitLab answered Yes to IAM-02.1 and IAM-02.2 in its CAIQ v4.0.3 submission on the CSA STAR Registry, and linked its password standard and password guidelines.

A good answer, if your policy supports it

IAM-02.1: Yes. Our Password Policy requires passwords of at least [N] characters, generated and stored in [password manager], never reused or shared, and MFA on every system that supports it. SSO is used where available. See Password Policy, "Requirements".

Note what is not in that answer: forced rotation every 90 days. NIST SP 800-63B-4 says verifiers "SHALL NOT require subscribers to change passwords periodically." GitLab's standard sets "Password expiration = No" (except for systems where a password is the only factor), and Tailscale's says passwords "do not need to be regularly rotated". If your policy drops rotation, say so plainly. A buyer's checklist that expects rotation can then see it is a deliberate choice.

When N/A is honest

Rarely. Even a company that uses SSO for everything has passwords somewhere: the identity provider, the password manager, break-glass accounts and devices. If you truly have no passwords for the in-scope service (for example, only hardware-key sign-in), answer Yes or No about the policy that covers that, and explain. Don't answer N/A.

Where answers usually go wrong

• Quoting the wrong scope. Tailscale's policy says it does not apply to its customers' passwords. A staff password policy proves IAM-02 for your staff, not for your product's end users. Some questionnaires ask about both.
• The annual review again. As with IAM-01, "reviewed at least annually" needs its own sentence or record.

How Citesheet handles it

In an earlier run on our benchmark labelled set (the "v2" rules), IAM-02.1 got the right value, but with a quote different from the one in our label. The quote may be just as good; we list it as a miss until a person checks it. Every Citesheet answer shows its quote, so that check takes seconds.