Password Policy Audit Against NIST SP 800-63B

<p>Most password policies still demand complexity rules and 90-day changes that make passwords worse, while missing the controls that matter. NIST Special Publication 800-63B changed the advice years ago: length over complexity, no forced periodic changes, screening against breached passwords, slow salted storage, and MFA where it counts.</p><p>In three lessons you learn modern password guidance and why it changed, audit an identity system's settings export against a baseline adopted from 800-63B with formulas, measure account risk from metadata (privileged accounts without MFA, MFA coverage, stale accounts), and write the remediation memo for the IT director in the Word lab.</p><p>This is an audit of policy and configuration on fictional practice data: you never see, handle or guess a password or a hash. Part of the Bartman Cybersecurity track (Professional Certificate in Cybersecurity, LSBF).</p>

Tools: Identity security, NIST SP 800-63B, MFA, Password policy, Excel, Audit