Glossary: Security Testing and Awareness Training

NIST SP 800-63B-4

Also written: SP 800-63B-4, 800-63B

NIST's authentication guidelines, finalized in August 2025. Passwords must be at least 15 characters (8 if used only with MFA), with no forced composition rules or periodic changes, blocklist checks, and password managers allowed.