A company has recently failed a security audit. Many of the end users have passwords older than 365 days. Which password policy type will prevent…

A password expiration policy is a technical control that enforces a maximum lifespan for user passwords. The audit failure was specifically caused by passwords being older than 365 days. Implementing a password expiration policy set to a specific period (e.g., 90, 180, or 365 days) would compel users to change their passwords before they become "stale." This directly addresses the audit finding by ensuring credentials are periodically refreshed, which mitigates the risk of a compromised password remaining valid indefinitely.

B. Length: This policy defines the minimum number of characters required for a password, which impacts its strength against brute-force attacks, not its age.

C. Recovery: This policy governs the process for users to reset a forgotten password and regain account access; it is unrelated to the password's valid duration.

D. Complexity: This policy mandates the use of different character sets (e.g., uppercase, lowercase, numbers, symbols) to increase password strength, not to manage its lifecycle.

1. Microsoft Corporation. (2023). Password Policy. Microsoft Learn. In the description of the "Maximum password age" policy setting, it states, "This security setting determines the period of time (in days) that a password can be used before the system requires the user to change it." This directly corresponds to the concept of password expiration. (Reference: docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/password-policy)

2. National Institute of Standards and Technology (NIST). (2017). NIST Special Publication 800-63B: Digital Identity Guidelines, Authentication and Lifecycle Management. Section 5.1.1.2, "Memorized Secret Verifiers," discusses password lifecycle events, including expiration. It states, "Verifiers SHALL require a subscriber to change their memorized secret... if there is evidence of compromise of the memorized secret." While modern guidance de-emphasizes arbitrary periodic expiration, the mechanism itself is defined as the control for forcing password changes after a set time. (DOI: https://doi.org/10.6028/NIST.SP.800-63b)

3. Saltzer, J. H., & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Communications of the ACM, 18(7), 377-408. This foundational paper on computer security principles discusses password protection mechanisms. In Section I.A.3.b, "Passwords," the concept of limiting the lifetime of a password is introduced as a countermeasure to threats like password theft, establishing the academic basis for password expiration policies. (DOI: https://doi.org/10.1145/361011.361062)