Glossary: MFA, Access Control and Passwords

NIST SP 800-63B-4

Also written: SP 800-63B-4, Special Publication 800-63B

NIST's authentication guide (July 2025). It requires 15-character minimums for password-only logins, a blocklist, no composition rules, no routine expiration, and biometrics only together with a physical authenticator.

Where the book teaches it

Chapter 1: Multifactor Authentication
Chapter 3: Access Management and Access Reviews
Chapter 4: Passkeys, Password Managers and Length
Chapter 5: Complexity, Reuse, Expiration and Age

Related terms

NIST (National Institute of Standards and Technology)password length blocklist password expiration restricted authenticator