14.4.1Work stations and all applications must have appropriate and needs based access controls with user names and passwords;
14.4.2The password must be of sufficient length, preferably eight digits or above, and must be alpha numeric with special characters;
14.4.3Mandatory “Password Change” settings must be activated in all systems and applications. The password change for normal users must be at least once in ninety (90) calendar days and thirty (30) calendar days in the case of Administrators; and
14.4.4“Auto Password Save” option must not be activated on any PC or in any work stations or for any applications.