BFCC-QIO Password Management Policy Checklist

Use this checklist to review password settings against CMS-published requirements. First confirm the applicable impact category and contract or system-specific security baseline: CMS’s guidance describes requirements for CMS systems, and should not be assumed to apply automatically to every BFCC-QIO system. The applicable system security plan and CMS direction should resolve any differences.

How do password requirements differ by system impact level?

Password rules depend in part on the system’s designated impact level: low, moderate, or high. FIPS Publication 199 provides the federal framework for categorizing information and systems according to the potential impact of a loss of confidentiality, integrity, or availability. Check the system’s documented categorization rather than assigning an impact level based solely on the BFCC-QIO program name.

Under the CMS password requirements, minimum lengths are the same for all three levels, while password history and composition differ: high-impact systems use a 12-password history and stronger category requirements; moderate- and low-impact systems use a 6-password history and less restrictive composition rules.

What minimum password lengths apply to users and administrators?

CMS specifies a minimum of 8 characters for regular users and 15 characters for administrators or other privileged users. Apply the privileged-account authentication rule to accounts authorized for administrative purposes based on business or technical need, and check the applicable system baseline for any stricter requirement.

The CMS password requirements page lists these minimum lengths for high-, moderate-, and low-impact systems. The CMS Medicare Administrative Contractor Acceptable Risk Safeguards also specifies 8 characters for regular accounts and 15 for administrator or privileged accounts.

Which password composition rules apply to each impact level?

For high-impact systems, the CMS Acceptable Risk Safeguards specify at least three of four character categories: uppercase letters (A–Z), lowercase letters (a–z), digits (0–9), and special characters. For moderate- and low-impact systems, the safeguards specify at least one category; the CMS password guide says using more than one category is optional.

CMS also says passwords must not contain dictionary names or words. Check the applicable system requirements for additional screening against common, expected, or compromised passwords. These rules do not mean every password must contain all four categories.

How many password changes are required before reuse?

Enforce password history so users cannot reuse their previous 12 passwords on high-impact systems. For moderate- and low-impact systems, the CMS requirement is a history of 6 passwords. These are minimum history sizes in the CMS password guidance and CMS Acceptable Risk Safeguards; a system-specific policy may require more.

How must systems store and transmit passwords?

Protect passwords cryptographically both when stored and when transmitted; do not store or send them in plaintext. The CMS Acceptable Risk Safeguards call for storage using an approved hash algorithm with a salt, preferably a keyed hash, and for cryptographically protected password transmission. A salted one-way hash protects stored credentials without keeping a recoverable plaintext password. The CMS password guidance likewise says systems must store and transmit only encrypted versions of passwords.

When must temporary passwords be changed?

Require an immediate change to a permanent password when a user first logs in with a temporary password, including after account recovery. Make the temporary credential usable only for the intended reset process and ensure it cannot remain as the user’s ongoing password. CMS’s password guidance says users must immediately change a temporary password; the CMS Acceptable Risk Safeguards also require a new password upon account recovery.

How many characters must differ when a password is changed?

CMS’s password guidance lists 12 changed characters for high-impact systems and 6 for moderate- and low-impact systems when the operating environment forces a minimum changed-character setting. However, the CMS Acceptable Risk Safeguards state that, if supported, systems should require at least 75% of the password’s character positions to change. Because those instructions express different thresholds, confirm the applicable system-specific baseline or security plan with the responsible security official before configuring this control.

As a final check, document the system’s impact category, applicable password lengths, composition and history settings, credential protections, temporary-password reset behavior, and approved password character-change threshold.

FAQs

How long must passwords be for regular users and administrators?

CMS specifies at least 8 characters for regular users and at least 15 for administrators or privileged users. Confirm whether the applicable system baseline requires longer passwords.

How many previous passwords must high-impact systems prevent users from reusing?

High-impact systems must prevent reuse of the previous 12 passwords under the CMS guidance.

Must passwords include a set number of character categories?

Under the CMS Acceptable Risk Safeguards, high-impact systems require at least 3 of 4 categories: uppercase letters, lowercase letters, digits, and special characters. Moderate- and low-impact systems require at least 1 category; using more than one is optional in the CMS password guide.

When must a temporary password be changed?

Require the user to change it immediately to a permanent password at the first login or following account recovery.