Alongside 2FA and SSO, we also offer configurable password control for added security.
This can be changed between low, medium or high by an Organisation Administrator.
There are 2 settings, one for standard users password requirements, and one for admin user password requirements
Medium is the default setting, however this will only be enforced if a user resets their password.
If you change the setting to high, users will need to set a new password when next logging in through the forgotten password process
On the web platform
On the record app
The settings cover password length, complexity (symbol, digits, upper case, etc.), enforced reset time, number of login attempts and lockout period.
These are the settings for low, medium and high:
High
Character length = 12
Minimum lower case characters = 1
Minimum upper case characters = 1
Minimum digits characters = 1
Minimum symbol characters = 1
History length = last 10 passwords cannot be reused
Warning on failed attempts = 5 incorrect attempts
Lock account = 10 incorrect attempts
Lockout period = 15 minutes
Medium (Default)
Character length = 8
Minimum lower case characters = 1
Minimum digits characters = 1
Warning on failed attempts = 5 incorrect attempts
Lock account = 10 incorrect attempts
Lockout period = 15 minutes
Low
Character length = 6
Warning on failed attempts = 5 incorrect attempts
Lock account = 15 incorrect attempts
Lockout period = 10 minutes